iopho-video-director
Pass
Audited by Gen Agent Trust Hub on Mar 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill automates the downloading of reference videos and metadata from external platforms during the context gathering phase (Phase 0) to assist in competitor analysis.
- [COMMAND_EXECUTION]: The production workflow (Phase 2) requires the execution of shell commands, including 'npx remotion render' for video generation and 'ffmpeg' for format manipulation. It also involves running a local shell script 'scripts/build-cc.sh' for subtitle processing.
- [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection as it processes data from external URLs and analyzed video content to inform the generation of project-specific storyboards and scripts. 1. Ingestion points: External video URLs and downloaded metadata processed in 'workflows/phase-0-context.md'. 2. Boundary markers: None identified in the workflow instructions. 3. Capability inventory: Subprocess execution via 'npx', 'ffmpeg', and 'bash', as well as extensive file-writing operations across the project directory ('workflows/phase-2-production.md'). 4. Sanitization: No explicit sanitization or validation logic for untrusted external content is provided in the skill files.
Audit Metadata