promo-video

Fail

Audited by Gen Agent Trust Hub on Sep 21, 2026

Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches voiceover audio from the ElevenLabs API (api.elevenlabs.io) and background music from Pixabay and Bensound. These are legitimate operations for the skill's primary purpose of video production.
  • [COMMAND_EXECUTION]: The skill utilizes several command-line tools for project initialization and media processing, including:
  • npm and npx for Remotion project setup and rendering.
  • ffmpeg and ffprobe for audio mixing, normalization, and duration checking.
  • python to execute a local script for voiceover generation.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data to provide creative options to the user. Analysis follows:
  • Ingestion points: Reads project history via git log and project content from README.md and the app/models/ directory (SKILL.md).
  • Boundary markers: None identified for the ingested file content or logs.
  • Capability inventory: Perform package installations (npm install), execute shell commands for rendering, and run media processing pipelines via FFmpeg (SKILL.md, scripts/generate_voiceover.py).
  • Sanitization: No explicit sanitization of commit messages or file content is performed before the data is used to generate dynamic options for the user.
Recommendations
  • HIGH: Downloads and executes remote code from: unknown (check file) - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Sep 21, 2026, 11:45 AM