create-video

Pass

Audited by Gen Agent Trust Hub on Oct 29, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill generates a TypeScript script at scripts/generate-audio.ts based on AI-generated content and then executes it using node to handle audio creation.
  • [COMMAND_EXECUTION]: Employs shell commands including curl for downloading media assets from external URLs and npx for managing the Remotion project environment.
  • [EXTERNAL_DOWNLOADS]: Fetches video and image assets from well-known services such as Pexels and Replicate via their respective APIs based on user search queries.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user prompts to define the video concept, which then drives the content of generated scripts and external asset searches.
  • Ingestion points: User concept breakdown in Phase 1 (SKILL.md).
  • Boundary markers: None identified; user input is used to generate a plan and subsequent assets.
  • Capability inventory: Includes local file system writes, script execution via node, network downloads via curl, and package execution via npx across the production lifecycle.
  • Sanitization: No evidence of input validation or escaping for the user-provided descriptions before they are used to generate the audio script or visual search queries.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 29, 2026, 03:03 PM