promo-video
Fail
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches voiceover audio from the ElevenLabs API (
api.elevenlabs.io) and background music from Pixabay and Bensound. These are legitimate operations for the skill's primary purpose of video production. - [COMMAND_EXECUTION]: The skill utilizes several command-line tools for project initialization and media processing, including:
npmandnpxfor Remotion project setup and rendering.ffmpegandffprobefor audio mixing, normalization, and duration checking.pythonto execute a local script for voiceover generation.- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data to provide creative options to the user. Analysis follows:
- Ingestion points: Reads project history via
git logand project content fromREADME.mdand theapp/models/directory (SKILL.md). - Boundary markers: None identified for the ingested file content or logs.
- Capability inventory: Perform package installations (
npm install), execute shell commands for rendering, and run media processing pipelines via FFmpeg (SKILL.md, scripts/generate_voiceover.py). - Sanitization: No explicit sanitization of commit messages or file content is performed before the data is used to generate dynamic options for the user.
Recommendations
- HIGH: Downloads and executes remote code from: unknown (check file) - DO NOT USE without thorough review
Audit Metadata