create-video
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill generates a TypeScript script at
scripts/generate-audio.tsbased on AI-generated content and then executes it usingnodeto handle audio creation. - [COMMAND_EXECUTION]: Employs shell commands including
curlfor downloading media assets from external URLs andnpxfor managing the Remotion project environment. - [EXTERNAL_DOWNLOADS]: Fetches video and image assets from well-known services such as Pexels and Replicate via their respective APIs based on user search queries.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user prompts to define the video concept, which then drives the content of generated scripts and external asset searches.
- Ingestion points: User concept breakdown in Phase 1 (SKILL.md).
- Boundary markers: None identified; user input is used to generate a plan and subsequent assets.
- Capability inventory: Includes local file system writes, script execution via
node, network downloads viacurl, and package execution vianpxacross the production lifecycle. - Sanitization: No evidence of input validation or escaping for the user-provided descriptions before they are used to generate the audio script or visual search queries.
Audit Metadata