blessing-video-weaver
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on
subprocess.runto execute command-line tools for video and audio processing. This is a core functional requirement for the skill's purpose. - Evidence: Multiple scripts, including
templates/normalize_all.py,templates/cut_segments.py, andtemplates/build_final.py, executeffmpegandffprobe. The scripttemplates/gfx/render_gfx.pyexecutesnpx hyperframesto render graphics. - [EXTERNAL_DOWNLOADS]: The skill fetches resources from well-known and reputable services to support its rendering and transcription features.
- Evidence:
- HTML templates in
templates/gfx/compositions/download theGSAPanimation library from thejsdelivrCDN. - The
templates/transcribe_all.pyscript utilizes thefaster-whisperlibrary, which fetches pre-trained models from the Hugging Face Hub. - The graphics pipeline uses
npxto execute tools from thehyperframesecosystem. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data (audio from uploaded video clips) which is transcribed and then used by the agent to structure the video edit, creating a surface for indirect prompt injection.
- Ingestion points: Raw audio is ingested and converted to text via
templates/transcribe_all.py. - Boundary markers: The instructions do not define specific delimiters or guardrails to distinguish between user audio content and task instructions during the weaving phase.
- Capability inventory: The skill has extensive capabilities to execute shell commands (
ffmpeg,npx) and modify the local file system. - Sanitization: No sanitization or filtering of the transcribed text is implemented before the agent processes it for thematic weaving.
Audit Metadata