promo-video
Fail
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches audio data from the ElevenLabs API and well-known royalty-free music sources (Bensound, Pixabay). These downloads are used to generate voiceovers and background music.
- [COMMAND_EXECUTION]: Uses
ffmpegandffprobevia thesubprocessmodule to normalize audio and verify scene timing. It also executesnpmandnpxto initialize and render the video project. - [INDIRECT_PROMPT_INJECTION]: Analyzes project documentation and history to suggest video features. 1. Ingestion points: Reads
git logandREADME.md(SKILL.md). 2. Boundary markers: Absent. 3. Capability inventory: Usesffmpeg,npm, andpythonsubprocesses (scripts/generate_voiceover.py and SKILL.md). 4. Sanitization: Presents suggestions as options for user selection, providing a manual review checkpoint.
Recommendations
- HIGH: Downloads and executes remote code from: unknown (check file) - DO NOT USE without thorough review
Audit Metadata