narrate-video
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious patterns or security vulnerabilities were detected. The skill follows secure development practices.
- [SAFE]: The skill handles sensitive API keys for Azure and Gemini by storing them in a local configuration file (
~/.narrate_video.env). It includes specific instructions for the agent to verify the existence of these keys without reading or displaying their values, preventing accidental credential exposure. - [COMMAND_EXECUTION]: The skill utilizes
ffmpegandffprobefor video processing via a Python template that executes these tools using safe subprocess execution patterns (passing arguments as a list), minimizing the risk of command injection. - [EXTERNAL_DOWNLOADS]: The skill connects to official, well-known service endpoints from Google and Microsoft for speech synthesis. These interactions are legitimate and do not involve downloading or executing untrusted code.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data such as video metadata. This risk is effectively mitigated by the tool's focused media-processing capabilities and the use of explicit delimiters in the TTS prompt structure.
Audit Metadata