talking-head-recut
Pass
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes system utilities including
ffmpegandffprobefor media processing, and thehyperframesCLI vianpxfor transcription and video rendering. - [SAFE]: Transcription is performed using a local instance of OpenAI's Whisper model through the
hyperframesCLI, ensuring that audio data and transcripts are processed entirely on the user's machine without external API dependencies. - [SAFE]: The skill enforces a secure rendering environment by mandating 'Hard rules' for generated HTML cards, which include the prohibition of
<script>tags, external URLs, and inline event handlers. This effectively mitigates the risk of malicious code execution during the headless browser rendering phase. - [SAFE]: All project assets, including the GSAP animation library and specialized fonts (Caveat, Inter, Virgil), are bundled locally within the skill directory, eliminating reliance on external CDNs and reducing the attack surface for supply chain interventions.
- [SAFE]: Data operations are restricted to a localized project structure (
videos/<project-name>/), ensuring that sensitive system files are not accessed or exposed during the skill's execution.
Audit Metadata