promo-video
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches audio assets from well-known services to support video creation.
- Downloads generated voiceover audio from the ElevenLabs API (
api.elevenlabs.io). - Downloads royalty-free background music from established media providers such as
bensound.comandpixabay.com. - [COMMAND_EXECUTION]: The skill uses system tools to process media and manage development environments.
- Executes
ffmpegandffprobevia Python'ssubprocessmodule inscripts/generate_voiceover.pyfor audio analysis and processing. - Uses shell commands like
git log,head, andlsinSKILL.mdto analyze the local repository and provide video context. - Utilizes
npmandnpxfor installing dependencies (lucide-react) and executing Remotion video rendering tasks. - [INDIRECT_PROMPT_INJECTION]: The skill analyzes project data to generate scripts, which represents a potential surface for processing untrusted content.
- Ingestion points: The skill reads local repository data including
git logand project source files (e.g.,README.md,app/models/) to generate promotional content. - Boundary markers: The workflow relies on interactive selection menus and a manual preview phase where the user must approve the generated video before final rendering.
- Capability inventory: The skill has the ability to write files to the local disk (audio and video artifacts) and perform network requests to the ElevenLabs API.
- Sanitization: While no explicit sanitization logic is shown in the scripts, the architecture incorporates human-in-the-loop verification at critical stages of the creative process.
Audit Metadata