libtv-advanced
Pass
Audited by Gen Agent Trust Hub on Mar 18, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill contains specific behavioral guidelines (referred to as the "Messenger Principle") instructing the agent to forward user prompts to the LibTV backend without modification or decomposition. These instructions are functional in nature, intended to ensure the quality of the backend generation, and do not attempt to bypass core safety guardrails or agent identity constraints.
- [EXTERNAL_DOWNLOADS]: The skill automatically downloads media assets from LibTV resource domains (
libtv-res.liblib.art) and official API endpoints. These operations are performed using standard Python libraries and are restricted to media file formats necessary for the video editing workflow. - [COMMAND_EXECUTION]: Video editing is performed locally using the
moviepylibrary, which executesffmpegcommands. This behavior is expected and documented for the skill's primary purpose of automated video creation and montage. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from the LibTV API, creating a potential surface for indirect injection.
- Ingestion points:
scripts/libtv_workflow.pyingests JSON messages from the LibTV polling endpoint. - Boundary markers: Absent.
- Capability inventory:
scripts/libtv_workflow.py(file writing for downloads),scripts/video_editor.py(reading and processing media files via MoviePy). - Sanitization: The skill uses specific regex and structural JSON parsing in
_extract_urls_from_contentto validate and extract only media URLs (PNG, JPG, MP4, etc.), effectively filtering out unexpected or malicious content in the generation results. - [SAFE]: Analysis of the source code confirms the lack of hardcoded credentials, obfuscation techniques, or persistence mechanisms. The skill's behavior aligns with its stated purpose of providing an enhanced video generation workflow.
Audit Metadata