hl-explainer-video

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill makes extensive use of system commands to process media, including ffmpeg for video assembly, ffprobe for metadata extraction, and platform-specific speech utilities like say, piper, or espeak-ng. These operations are standard for the skill's stated purpose of video generation.
  • [DYNAMIC_EXECUTION]: The skill generates Python source code for Manim scenes based on user-provided topics and executes them using the manim CLI. While this involves runtime script generation and execution, it is the core mechanism required to produce animated visuals for the video.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from the local repository or external cited sources to build its scripts.
  • Ingestion points: Reads facts from repository files or external sources to generate the video script.
  • Boundary markers: The instructions do not specify explicit delimiters or guardrails to distinguish between trusted data and potentially malicious instructions within the source material.
  • Capability inventory: The skill has the ability to execute shell commands (ffmpeg, manim) and write files to the local system.
  • Sanitization: No specific sanitization or filtering logic is defined for the ingested data before it is incorporated into the script or visual generation logic.
  • [EXTERNAL_DOWNLOADS]: The skill references ElevenLabs as a potential voice provider and suggests using uvx to run manim. ElevenLabs is a well-known service, and the use of environment variables for API keys follows standard security practices to prevent credential exposure.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 09:32 AM