remix-music-video-ad-from-sample
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
ffmpegfor various media processing tasks, including video assembly, audio normalization to -14 LUFS, and burning cinematic captions using thelibassfilter. - [EXTERNAL_DOWNLOADS]: The instructions involve installing the
imageio-ffmpegPython package and utilizing thegoose-videoNode package vianpxto handle authentication and manage the generative pipeline. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and interpolates untrusted data, such as brand research and user-supplied steering "angles," into prompts for external generative AI services.
- Ingestion points: Reads project data, source templates, and brand research files from the local filesystem; accepts arbitrary user text for the creative "angle."
- Boundary markers: Does not explicitly define structural delimiters or clear instructions to ignore embedded commands when interpolating brand data or user steering into the
concept.jsonfile. - Capability inventory: The skill has the capability to execute shell commands, perform file system writes, and conduct network operations through established vendor proxies.
- Sanitization: Employs basic sanitization by stripping specific artist names from music vibe descriptions to prevent triggering service provider safety filters.
Audit Metadata