promo-video

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches audio assets from well-known services to support video creation.
  • Downloads generated voiceover audio from the ElevenLabs API (api.elevenlabs.io).
  • Downloads royalty-free background music from established media providers such as bensound.com and pixabay.com.
  • [COMMAND_EXECUTION]: The skill uses system tools to process media and manage development environments.
  • Executes ffmpeg and ffprobe via Python's subprocess module in scripts/generate_voiceover.py for audio analysis and processing.
  • Uses shell commands like git log, head, and ls in SKILL.md to analyze the local repository and provide video context.
  • Utilizes npm and npx for installing dependencies (lucide-react) and executing Remotion video rendering tasks.
  • [INDIRECT_PROMPT_INJECTION]: The skill analyzes project data to generate scripts, which represents a potential surface for processing untrusted content.
  • Ingestion points: The skill reads local repository data including git log and project source files (e.g., README.md, app/models/) to generate promotional content.
  • Boundary markers: The workflow relies on interactive selection menus and a manual preview phase where the user must approve the generated video before final rendering.
  • Capability inventory: The skill has the ability to write files to the local disk (audio and video artifacts) and perform network requests to the ElevenLabs API.
  • Sanitization: While no explicit sanitization logic is shown in the scripts, the architecture incorporates human-in-the-loop verification at critical stages of the creative process.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 11:43 PM