motion-video-director
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes Python's subprocess and Node.js child_process to orchestrate FFmpeg, ffprobe, and internal rendering scripts. These operations are essential for video processing and are handled by passing arguments as lists rather than raw shell strings, which reduces injection risk.- [EXTERNAL_DOWNLOADS]: The skill retrieves AI models from Zenodo (an official research repository) and generates audio via the ElevenLabs API. It implements rigorous integrity checks using SHA256 and MD5 hashes and enforces the use of PyTorch's weights_only=True to prevent arbitrary code execution during model loading.- [INDIRECT_PROMPT_INJECTION]: As a tool designed to process external media and browse websites for assets via Playwright, it has an inherent exposure to indirect injection. The skill manages this surface by using isolated browser contexts and strictly local-only configurations for media analysis models.- [DYNAMIC_EXECUTION]: The JavaScript-based rendering engine uses dynamic imports to load project-specific scene modules. This architecture is standard for modular rendering and does not incorporate untrusted external input into the execution flow.
Audit Metadata