changelog-video
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute multiple shell commands for its operations. This includes using
ffmpegfor video encoding and processing,nodeto run included scripts for TTS alignment and project validation, anduvxfor running theopenai-whispermodel. It also uses theawsCLI for CloudFront cache invalidation and theheygenCLI for voice synthesis. - [EXTERNAL_DOWNLOADS]: The skill relies on external libraries and tools. The video composition template (
master-skeleton.html) loads the GSAP animation library from a public CDN (JSDelivr). Additionally, the skill utilizesuvxto dynamically run theopenai-whisperpackage for audio alignment if primary timestamping fails. - [INDIRECT_PROMPT_INJECTION]: The skill functions by ingesting untrusted markdown data (user changelogs) to drive the narrative and visualization logic of the video. While this processes external content, the risk is mitigated by the highly structured build process that maps items to a predefined visualization registry and uses a rigid HTML/CSS/JS scaffold.
Audit Metadata