videoprodutor
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads font assets from Google Fonts (
fonts.googleapis.com) and includes the GSAP animation library from the JSDelivr CDN (cdn.jsdelivr.net). These are well-known technology services used for legitimate purposes. - [COMMAND_EXECUTION]: The orchestration scripts execute various local command-line tools including
ffprobefor media metadata,hyperframesfor rendering, andpython3for text-to-speech processing. These are integral to the skill's primary function of video production. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core functionality of processing external links provided by the user.
- Ingestion points: User-supplied URLs or subjects are used to generate video scripts and plans.
- Boundary markers: The templates do not currently implement specific delimiters or 'ignore' instructions to isolate content retrieved from external links.
- Capability inventory: The skill possesses file-write capabilities and the ability to execute system commands (FFmpeg, Node.js, Python).
- Sanitization: No explicit input sanitization or validation of the content fetched from external links was observed in the scripts.
Audit Metadata