markdown-video
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Python
subprocessmodule to call system utilities includingffmpeg,ffprobe, andcp. These operations are used for audio merging, image conversion, and video concatenation. Commands are constructed as lists and passed tosubprocess.run, which prevents common shell injection vulnerabilities. - [EXTERNAL_DOWNLOADS]: The scripts
generate_audio.py,create_slides_gemini.py, andgenerate_section_images.pyperform network requests to official OpenAI and Google Gemini API endpoints to generate TTS audio and slide images. These are well-known technology services and the interactions are consistent with the skill's stated purpose. - [DATA_EXPOSURE_AND_EXFILTRATION]: The skill requires
OPENAI_API_KEYandGEMINI_API_KEYto be set in the environment. This is a standard and recommended practice for secret management in developer tools. There is no evidence of these keys being transmitted to unauthorized third parties.
Audit Metadata