paper2video
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- External Dependency Installation: The skill involves the installation of external components from third-party GitHub repositories, specifically ai-nuts/pptx2video and hugohe3/ppt-master. While these tools are central to the video generation process, the use of external code sources outside of the primary vendor or trusted organizations is a consideration for environment security.
- Indirect Prompt Injection Surface: The skill ingests and processes content from research papers to automate narration and visual cue generation. This content is then interpreted by the agent for script optimization and duration planning, which creates a potential surface for indirect prompt injection if the source documents contain adversarial instructions.
- System Command Execution: The skill executes system-level binaries such as ffmpeg and ffprobe via subprocess calls to perform media analysis. Although these calls are implemented using structured argument lists to minimize risk, the execution of external tools on generated or processed files is a pattern that warrants standard security oversight.
Audit Metadata