creator-pip-overlay-video
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The Python scripts
scripts/composite.pyandscripts/slice_vo.pyexecute FFmpeg and FFprobe to process video and audio segments. These calls are implemented using list-based arguments insubprocess.run, which is the standard safe practice to prevent shell injection vulnerabilities. - [EXTERNAL_DOWNLOADS]: The skill interacts with the ElevenLabs API to generate voiceover audio and sound effects. This is a well-known service and the interaction is necessary for the skill's core functionality. No unauthorized external downloads or connections were identified.
- [PROMPT_INJECTION]: The skill generates AI prompts and scripts based on user-provided inputs (
conceptandbeats). While this presents an indirect prompt injection surface, it is an intended part of the text-to-video workflow and does not include instructions designed to bypass agent safety filters or override system behavior. - [SAFE]: All credentials and API keys (FAL_API_KEY, ELEVENLABS_API_KEY, KLAP_API_KEY) are managed via environment variables in a
.envfile, which follows industry-standard security practices for secret management.
Audit Metadata