promo-video

Fail

Audited by Gen Agent Trust Hub on Oct 18, 2026

Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches audio data from the ElevenLabs API and well-known royalty-free music sources (Bensound, Pixabay). These downloads are used to generate voiceovers and background music.
  • [COMMAND_EXECUTION]: Uses ffmpeg and ffprobe via the subprocess module to normalize audio and verify scene timing. It also executes npm and npx to initialize and render the video project.
  • [INDIRECT_PROMPT_INJECTION]: Analyzes project documentation and history to suggest video features. 1. Ingestion points: Reads git log and README.md (SKILL.md). 2. Boundary markers: Absent. 3. Capability inventory: Uses ffmpeg, npm, and python subprocesses (scripts/generate_voiceover.py and SKILL.md). 4. Sanitization: Presents suggestions as options for user selection, providing a manual review checkpoint.
Recommendations
  • HIGH: Downloads and executes remote code from: unknown (check file) - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Oct 18, 2026, 07:05 PM