guided-music-video
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation and execution of external software packages required for audio processing and video rendering.
- Node.js: Executes
@helios-project/clivianpxto perform video verification, frame-sheet generation, and final rendering. - Python: Recommends installing
demucsfor audio stem separation andstable-tsorstable-whisperfor lyric alignment. - [DYNAMIC_EXECUTION]: The skill uses dynamic generation of logic and scripts to define media timelines and alignment.
- It provides templates for generating JavaScript logic (
SCENESarray) that maps song beats to visual scenes. - It includes a Python script (
align.py) designed to be generated or used by the agent to create timing metadata (lyrics.json). - [INDIRECT_PROMPT_INJECTION]: The skill parses user-supplied text and JSON data (lyrics and timing cues) which represents an attack surface for indirect instructions.
- Ingestion points: Processes
lyrics.txtandlyrics.jsonfiles from the local filesystem during the alignment and rendering phases. - Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded commands within the lyric text.
- Capability inventory: The skill has access to shell execution (
npx,ffmpeg,pip) and file system writes. - Sanitization: Lyric content is used for display and timing logic as raw string data without explicit sanitization for escape characters or control sequences.
Audit Metadata