motion-explainer-video
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from project files such as
SCRIPT.md,STORYBOARD.md,shots.json, andgen_prompts.jsonto generate inputs for sub-agents and external tools. - Ingestion points: Text and JSON configuration files including
SCRIPT.md,STORYBOARD.md,shots.json, andgen_prompts.json. - Boundary markers: The skill does not implement explicit boundary markers or instructions to disregard embedded commands in the processed data.
- Capability inventory: Subprocess execution (ffmpeg, codex CLI), network access for asset retrieval, and extensive file system write operations.
- Sanitization: The skill lacks robust sanitization for user-provided strings before interpolation into prompts or command arguments.
- [COMMAND_EXECUTION]: Several scripts utilize
subprocess.runto invoke system utilities and external tools for media processing. scripts/voice_meta.pyandscripts/fix_voice.pycallffmpegandffprobefor audio analysis and normalization.scripts/hw_check.pyexecutesnvidia-smiand other system commands to detect hardware capabilities.scripts/codex_images.pyinvokes thecodexcommand to generate images through sub-agent reasoning.scripts/ai_video.pyexecutes a user-defined runner command to synthesize video clips.- [EXTERNAL_DOWNLOADS]: The skill fetches external resources from well-known repositories and services.
scripts/fetch_fonts.shdownloads open-source fonts from the official Google Fonts GitHub organization and other known font repositories.scripts/find_images.pysearches and downloads images from Wikimedia Commons using the media API.scripts/edge_tts_voice.pyconnects to Microsoft's online neural voice services to generate narration.- [DYNAMIC_EXECUTION]: The skill dynamically constructs and executes commands based on local configuration and user-supplied repository paths.
scripts/breeze_voice.pyexecutes a Python script from a local repository path provided by the user.scripts/ai_video.pybuilds shell commands by replacing placeholders in a configuration string obtained fromvideo_config.json.
Audit Metadata