markdown-video

Pass

Audited by Gen Agent Trust Hub on Oct 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the Python subprocess module to call system utilities including ffmpeg, ffprobe, and cp. These operations are used for audio merging, image conversion, and video concatenation. Commands are constructed as lists and passed to subprocess.run, which prevents common shell injection vulnerabilities.
  • [EXTERNAL_DOWNLOADS]: The scripts generate_audio.py, create_slides_gemini.py, and generate_section_images.py perform network requests to official OpenAI and Google Gemini API endpoints to generate TTS audio and slide images. These are well-known technology services and the interactions are consistent with the skill's stated purpose.
  • [DATA_EXPOSURE_AND_EXFILTRATION]: The skill requires OPENAI_API_KEY and GEMINI_API_KEY to be set in the environment. This is a standard and recommended practice for secret management in developer tools. There is no evidence of these keys being transmitted to unauthorized third parties.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 18, 2026, 05:15 PM