motion-explainer-video

Pass

Audited by Gen Agent Trust Hub on Oct 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from project files such as SCRIPT.md, STORYBOARD.md, shots.json, and gen_prompts.json to generate inputs for sub-agents and external tools.
  • Ingestion points: Text and JSON configuration files including SCRIPT.md, STORYBOARD.md, shots.json, and gen_prompts.json.
  • Boundary markers: The skill does not implement explicit boundary markers or instructions to disregard embedded commands in the processed data.
  • Capability inventory: Subprocess execution (ffmpeg, codex CLI), network access for asset retrieval, and extensive file system write operations.
  • Sanitization: The skill lacks robust sanitization for user-provided strings before interpolation into prompts or command arguments.
  • [COMMAND_EXECUTION]: Several scripts utilize subprocess.run to invoke system utilities and external tools for media processing.
  • scripts/voice_meta.py and scripts/fix_voice.py call ffmpeg and ffprobe for audio analysis and normalization.
  • scripts/hw_check.py executes nvidia-smi and other system commands to detect hardware capabilities.
  • scripts/codex_images.py invokes the codex command to generate images through sub-agent reasoning.
  • scripts/ai_video.py executes a user-defined runner command to synthesize video clips.
  • [EXTERNAL_DOWNLOADS]: The skill fetches external resources from well-known repositories and services.
  • scripts/fetch_fonts.sh downloads open-source fonts from the official Google Fonts GitHub organization and other known font repositories.
  • scripts/find_images.py searches and downloads images from Wikimedia Commons using the media API.
  • scripts/edge_tts_voice.py connects to Microsoft's online neural voice services to generate narration.
  • [DYNAMIC_EXECUTION]: The skill dynamically constructs and executes commands based on local configuration and user-supplied repository paths.
  • scripts/breeze_voice.py executes a Python script from a local repository path provided by the user.
  • scripts/ai_video.py builds shell commands by replacing placeholders in a configuration string obtained from video_config.json.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 19, 2026, 06:24 PM