geometry-math-proof-remotion
Fail
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
scripts/generate_tts.pyscript makes requests toapi.minimaxi.comto synthesize speech. It then downloads binary data from a URL provided in the API response or decodes hex-encoded audio data. - [COMMAND_EXECUTION]: The skill uses
subprocess.runto executeffmpeg,ffprobe, andcpcommands on the host system. These are used for audio processing, duration measurement, and file management. - [REMOTE_CODE_EXECUTION]: Binary data downloaded from the remote TTS API is written to disk and subsequently processed by
ffmpegandffprobe. Processing untrusted media files with complex codecs can present a security risk if the remote source is compromised or malicious. - [CREDENTIALS_UNSAFE]: The script
scripts/generate_tts.pyattempts to read an API key from a.envfile located in the skill's root directory using a regex search on the file's content. While intended for legitimate API authentication, this pattern involves accessing and potentially exposing sensitive configuration files.
Recommendations
- HIGH: Downloads and executes remote code from: unknown (check file) - DO NOT USE without thorough review
Audit Metadata