add-voiceover
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
@elevenlabs/elevenlabs-jspackage from the official npm registry and usesnpxto execute tools from ElevenLabs and the Remotion ecosystem. These are recognized services, and the use of their official packages for their intended purpose is standard practice.\n- [COMMAND_EXECUTION]: Executes shell commands to manage the development environment, including initializing the ElevenLabs CLI, running the Remotion studio, and executing local scripts to process media assets.\n- [DYNAMIC_EXECUTION]: Instructions guide the agent to generate a TypeScript utility (scripts/generate-audio.ts) which is then executed via Node.js. This script is used to automate the calling of the ElevenLabs API with user-provided text to generate audio files.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest user-provided scripts or descriptions which are then used in script generation and audio synthesis.\n - Ingestion points: User-provided narration scripts or descriptive prompts in the chat context.\n
- Boundary markers: No specific delimiters or safety instructions are prescribed for handling the user-provided text.\n
- Capability inventory: Command execution (
npm,npx,node), file system writes (creation of.tsand.mp3files), and network access (API calls to ElevenLabs).\n - Sanitization: The skill follows standard string interpolation for code generation without specific sanitization of the user input.
Audit Metadata