render-whiteboard-explainer

Pass

Audited by Gen Agent Trust Hub on Oct 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill makes extensive use of the subprocess module to orchestrate local tools and internal scripts. It calls ffmpeg and ffprobe for video encoding, audio mastering, and metadata inspection. It also executes its own sub-scripts (e.g., gen-art.py, render.py, solve-layout.py) using sys.executable to manage the multi-stage build process.
  • [EXTERNAL_DOWNLOADS]: The skill communicates with external APIs for media generation. It uses a centralized media_proxy.py helper to route requests for voice generation (ElevenLabs) and image generation (FAL) through GooseWorks-managed proxy endpoints. It also bundles and uses open-source fonts (Permanent Marker, Titan One) from Google Fonts.
  • [DYNAMIC_EXECUTION]: The renderer (render.py) and layout solver (solve-layout.py) use importlib.util to dynamically load internal helper modules (lettering.py, anchors.py, illos.py) from the skill's script directory. This is used for modular code organization within the skill.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided content from beats.json, including voiceover scripts and drawing descriptions. This content is interpolated into prompt templates for generative AI models. While this presents an attack surface for indirect prompt injection, the risk is inherent to the generative nature of the skill and is mitigated by structured prompt templates and human review stages described in the documentation.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 27, 2026, 01:55 PM