ascii-video
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of
subprocess.runandsubprocess.Popento invokeffmpegandffprobe. These operations are strictly scoped to media decoding, encoding, and feature extraction, which constitutes the primary intended purpose of the skill. - [EXTERNAL_DOWNLOADS]: The skill includes integration with the ElevenLabs API (
api.elevenlabs.io) for generating text-to-speech audio clips. ElevenLabs is a well-known service, and the network operations are limited to data exchange for voice synthesis. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, including video files, audio tracks, and SRT subtitle files. While this creates an attack surface for indirect prompt injection, the skill's processing logic is focused on mathematical transformations and imaging rasterization rather than natural language interpretation, significantly mitigating the risk.
- [COMMAND_EXECUTION]: A cleanup function (
cleanup_render_artifacts) is provided to remove intermediate render files. It usesshutil.rmtreeandos.removeto delete temporary directories and files matching specific patterns (e.g.,*.wav,ffmpeg_*.log) created during the video production process.
Audit Metadata