vocabulary-video-pipeline
Pass
Audited by Gen Agent Trust Hub on Apr 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The entry script
generate_word_video.pyexecutes several CLI tools includingnpm,npx,python3, andlark-clito orchestrate the video production workflow. These commands are invoked using list-based arguments, which is a secure practice to prevent shell injection. - [EXTERNAL_DOWNLOADS]: The skill instructions specify cloning a vendor repository from GitHub and installing necessary packages via standard package managers (
npmandpip). - [DATA_EXFILTRATION]: The skill transmits text content to the Bytedance (Volcengine) OpenSpeech API to synthesize audio. This operation is central to the skill's functionality and communicates with a well-known service.
- [CREDENTIALS_UNSAFE]: The skill utilizes environment variables to manage Volcengine TTS API credentials, following standard security practices for secret management in development environments.
Audit Metadata