datamagic-video
Fail
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's README.md file directs users to download and execute an installation script from the author's official GitHub repository (HKUSTDial/DataMagic). It also specifies dependencies on common packages like 'edge-tts' and 'Remotion'.
- [REMOTE_CODE_EXECUTION]: The skill facilitates the execution of remote scripts through a documented curl-to-bash pipeline, specifically targeting resources maintained by the skill author.
- [COMMAND_EXECUTION]: To achieve its purpose, the skill instructs the agent to perform command-line operations, including package installation and script execution for audio generation and video rendering.
- [INDIRECT_PROMPT_INJECTION]: As the skill is designed to ingest and narrate data from CSV and Excel files, it possesses an attack surface for indirect prompt injection where malicious content in the data could potentially influence agent behavior or output.
- [DYNAMIC_EXECUTION]: The skill involves creating and executing dynamic configurations (DVSpec) and React-based rendering code at runtime based on the structure of the input data.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/HKUSTDial/DataMagic/main/install.sh - DO NOT USE without thorough review
Audit Metadata