motion-explainer
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Several Python scripts (
edge_tts_voice.py,breeze_voice.py,fix_voice.py,voice_meta.py, andhw_check.py) utilizesubprocess.runto invoke system utilities. These includeffmpegandffprobefor audio processing,nvidia-smifor GPU detection, and the Breeze TTS command-line interface. These operations are standard for media automation pipelines and are used to process project assets or optimize performance based on hardware capabilities. - [EXTERNAL_DOWNLOADS]: The
fetch_fonts.shscript downloads open-source fonts from reputable GitHub repositories, including the official Google Fonts repository and the GenSeki Gothic project. It also utilizesnpmto temporarily fetch font packages. These downloads are performed to ensure the project has local access to required CJK and Latin typefaces for offline rendering. - [INDIRECT_PROMPT_INJECTION]: The skill operates on scripts and storyboards that may be generated from external research or user input. While this creates a potential surface for indirect prompt injection, the skill's workflow uses structured templates (JSON and Markdown) and specific processing scripts that mitigate the risk of accidental instruction override.
- [DYNAMIC_EXECUTION]: The
hw_check.pyscript performs detailed system profiling, including reading/proc/meminfoon Linux and usingctypesto call the WindowsGlobalMemoryStatusExAPI. This information is used solely to provide the user with recommended settings (such as the number of parallel render workers) to ensure stable video output on different hardware configurations.
Audit Metadata