video-cover-image

Pass

Audited by Gen Agent Trust Hub on Aug 30, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/render_text_cover.py uses subprocess.check_output to call the fc-match utility. This is used to dynamically locate system fonts (e.g., Hiragino Sans GB, PingFang SC) for rendering text on generated covers. The inputs to this command are selected from a hardcoded list of font names and do not incorporate user-provided data, preventing command injection vulnerabilities.
  • [SAFE]: The skill uses a local Python script for text rendering and standard image generation prompts. All referenced assets, such as the presenter's identity image (references/itwanger-cover-character.png), are local to the skill's distribution and follow the vendor's established naming conventions.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 30, 2026, 06:40 AM
Security Audit — agent-trust-hub — video-cover-image