kortix-presentation
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute various local commands for development, rendering, and testing tasks. Examples include
bun apps/web/scripts/film/render.tsfor video rendering,python3 apps/web/scripts/film/soundtrack.pyfor audio processing, andpnpm/npxfor typechecking and linting. The instructions also include setting environment variables in the shell, such asELEVENLABS_API_KEY, to facilitate these operations. These commands are standard for the described workflow and target local project scripts. - [EXTERNAL_DOWNLOADS]: The film rendering process fetches sound effects from the ElevenLabs API. The instructions reference using an environment variable to authenticate with the ElevenLabs service for sound generation (
POST /v1/sound-generation). ElevenLabs is a well-known service, and the download of media assets is a legitimate part of the video production workflow. - [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow where the agent ingests content from other parts of the repository to generate presentations. Ingestion points: The skill reads claims and content from marketing modules located in
apps/web/src/features/marketing/*/content.ts(documented in SKILL.md under 'Copy accuracy'). Boundary markers: None explicitly defined for these internal content files, as they are treated as authoritative sources within the project. Capability inventory: The skill has the ability to execute shell commands (bun,python3) and modify project files (registry updates, new component creation). Sanitization: Relies on internal project 'accuracy gates' and manual code review processes described in the documentation.
Audit Metadata