video-cover-image
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/render_text_cover.pyusessubprocess.check_outputto call thefc-matchutility. This is used to dynamically locate system fonts (e.g., Hiragino Sans GB, PingFang SC) for rendering text on generated covers. The inputs to this command are selected from a hardcoded list of font names and do not incorporate user-provided data, preventing command injection vulnerabilities. - [SAFE]: The skill uses a local Python script for text rendering and standard image generation prompts. All referenced assets, such as the presenter's identity image (
references/itwanger-cover-character.png), are local to the skill's distribution and follow the vendor's established naming conventions.
Audit Metadata