motion-explainer

Pass

Audited by Gen Agent Trust Hub on Oct 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: Several Python scripts (edge_tts_voice.py, breeze_voice.py, fix_voice.py, voice_meta.py, and hw_check.py) utilize subprocess.run to invoke system utilities. These include ffmpeg and ffprobe for audio processing, nvidia-smi for GPU detection, and the Breeze TTS command-line interface. These operations are standard for media automation pipelines and are used to process project assets or optimize performance based on hardware capabilities.
  • [EXTERNAL_DOWNLOADS]: The fetch_fonts.sh script downloads open-source fonts from reputable GitHub repositories, including the official Google Fonts repository and the GenSeki Gothic project. It also utilizes npm to temporarily fetch font packages. These downloads are performed to ensure the project has local access to required CJK and Latin typefaces for offline rendering.
  • [INDIRECT_PROMPT_INJECTION]: The skill operates on scripts and storyboards that may be generated from external research or user input. While this creates a potential surface for indirect prompt injection, the skill's workflow uses structured templates (JSON and Markdown) and specific processing scripts that mitigate the risk of accidental instruction override.
  • [DYNAMIC_EXECUTION]: The hw_check.py script performs detailed system profiling, including reading /proc/meminfo on Linux and using ctypes to call the Windows GlobalMemoryStatusEx API. This information is used solely to provide the user with recommended settings (such as the number of parallel render workers) to ensure stable video output on different hardware configurations.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 18, 2026, 12:46 PM