jianying-audio
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external media metadata and project draft files which could serve as vectors for indirect instructions. * Ingestion points: Media probe results and draft file content (SKILL.md Step 3). * Boundary markers: Employs structural validation and project integrity checks (SKILL.md Step 6). * Capability inventory: File system access for isolated writes and execution of the 'jianying' CLI. * Sanitization: Strict adherence to tool-probed facts and rejection of unknown schemas.
- [COMMAND_EXECUTION]: The skill utilizes a local Rust CLI to perform media manipulation tasks. * Evidence: Commands such as 'media probe', 'media add-audio', and 'timeline volume' are core to the workflow. * Mitigation: Execution is constrained by version and capability checks performed at runtime.
- [EXTERNAL_DOWNLOADS]: The skill can interact with external Text-to-Speech (TTS) providers for audio generation. * Evidence: Mentions of cloud-based TTS requests in references/workflow.md. * Mitigation: All cloud-based requests require explicit user approval and are tracked via a cost ledger.
Audit Metadata