giggle-generation-tv-avatar-video
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides Python scripts to automate video generation tasks. These scripts are executed by the agent to interface with the Giggle API gateway.
- [EXTERNAL_DOWNLOADS]: The skill performs network requests to https://giggle.pro to submit media URLs and poll for task status. It also includes a utility to download generated video content to the local filesystem. This activity is restricted to the vendor's own infrastructure.
- [CREDENTIALS_UNSAFE]: Security for API keys is handled by requiring users to set a GIGGLE_API_KEY environment variable. The skill correctly identifies missing credentials and provides instructions for secure setup, following best practices for secret management.
- [PROMPT_INJECTION]: Analysis of the skill's input handling for indirect prompt injection indicates that the attack surface is managed through several validation layers.
- Ingestion points: The skill ingests user-provided text for TTS and URLs for media files via CLI parameters in tv_avatar_video.py and tv_voice_clone.py.
- Boundary markers: Requests are encapsulated in structured JSON objects sent to a specific API gateway.
- Capability inventory: Scripts have permissions to perform network operations and write files to local storage (e.g., saving the output video).
- Sanitization: The implementation includes character count limits (2700), stripping of backticks from URLs, and regex validation for pause tags within the text scripts.
Audit Metadata