ascii-video

Pass

Audited by Gen Agent Trust Hub on Sep 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill makes extensive use of the subprocess module to interface with ffmpeg and ffprobe. These tools are used for decoding source media, encoding batch-rendered segments, and muxing the final audio-video output. This functionality is core to the skill's purpose as a video production pipeline.
  • [EXTERNAL_DOWNLOADS]: Optionally connects to the ElevenLabs API (api.elevenlabs.io) for synthetic speech generation. ElevenLabs is a recognized and well-known service for high-quality text-to-speech tasks.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external media and text inputs (such as SRT files and lyrics) that could theoretically contain malicious instructions.
  • Ingestion points: Untrusted text from lyrics and SRT files, as well as metadata from video/audio files, are ingested through the components defined in inputs.md.
  • Boundary markers: No specific boundary delimiters or prompt-based guardrails are used for these inputs.
  • Capability inventory: The skill's capabilities are focused on media manipulation (via ffmpeg and Pillow) and speech synthesis (via the ElevenLabs API).
  • Sanitization: External text content is used for visual rendering and API calls without explicit sanitization, though the risk is minimized by the specialized nature of the processing tools.
  • [DYNAMIC_EXECUTION]: The render pipeline utilizes multiprocessing and concurrent.futures to perform parallel batch rendering of video frames. This involves the dynamic serialization and execution of scene functions across multiple worker processes to optimize performance.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 8, 2026, 07:01 PM
Security Audit — agent-trust-hub — ascii-video