create-founder-led-video-ad
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes local utility scripts and system-level binaries including
ffmpegandffprobeto perform video manipulation, audio extraction, and metadata analysis. These operations are restricted to the local filesystem and serve the primary functional goal of video editing. - [EXTERNAL_DOWNLOADS]: The workflow integrates with third-party service providers, specifically FAL for transcription and Klap for animated captioning. These external dependencies are standard for cloud-based media processing tasks and are documented neutrally in the instructions.
- [PROMPT_INJECTION]: The skill represents an indirect prompt injection surface as it ingests untrusted data from the
brand_briefand transcription text to influence LLM-based video planning. Ingestion points:brand_briefinput (SKILL.md); Boundary markers: None explicitly defined in the provided workflow; Capability inventory: Local file system access, subprocess execution offfmpegand Python scripts; Sanitization: The skill employs an Edit Decision List validator (edl_validate.py) that checks the structure and parameters of the generated plan against nine validation rules before the rendering phase, effectively mitigating risks of malformed instruction execution.
Audit Metadata