hl-explainer-video
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of system commands to process media, including
ffmpegfor video assembly,ffprobefor metadata extraction, and platform-specific speech utilities likesay,piper, orespeak-ng. These operations are standard for the skill's stated purpose of video generation. - [DYNAMIC_EXECUTION]: The skill generates Python source code for Manim scenes based on user-provided topics and executes them using the
manimCLI. While this involves runtime script generation and execution, it is the core mechanism required to produce animated visuals for the video. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from the local repository or external cited sources to build its scripts.
- Ingestion points: Reads facts from repository files or external sources to generate the video script.
- Boundary markers: The instructions do not specify explicit delimiters or guardrails to distinguish between trusted data and potentially malicious instructions within the source material.
- Capability inventory: The skill has the ability to execute shell commands (
ffmpeg,manim) and write files to the local system. - Sanitization: No specific sanitization or filtering logic is defined for the ingested data before it is incorporated into the script or visual generation logic.
- [EXTERNAL_DOWNLOADS]: The skill references ElevenLabs as a potential voice provider and suggests using
uvxto runmanim. ElevenLabs is a well-known service, and the use of environment variables for API keys follows standard security practices to prevent credential exposure.
Audit Metadata