making-content
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill automates the retrieval of development assets from established and trusted platforms.
- It fetches fonts from Google Fonts (
fonts.googleapis.com). - It retrieves project logos and avatars from GitHub (
github.com,avatars.githubusercontent.com). - It downloads royalty-free music from Incompetech (
incompetech.com). - It utilizes cloud-based TTS services from Microsoft Edge and Volcengine (Bytedance).
- [COMMAND_EXECUTION]: Several Python scripts (
render.py,timeline.py) utilizesubprocessto interface with standard media processing tools likeffmpegandffprobe. This is the intended primary purpose of the skill to perform video compositing and audio mixing. - [DATA_EXPOSURE]: The skill includes instructions for handling API keys (specifically for Volcengine TTS). It explicitly mandates using environment variables and warns against hardcoding secrets in files, scripts, or commits. It also suggests revoking temporary keys after use.
- [DYNAMIC_EXECUTION]: The pipeline uses Playwright (
capture.py,lint.py,render.py) to render HTML templates into images and video frames. This is a local-only operation for generating visual content based on user-provided drafts. - [SAFE]: Static analysis hints regarding
subprocessusage inscripts/timeline.pyandscripts/render.pyare confirmed as benign, as they are used to invoke standard system utilities for media rendering according to the skill's stated purpose.
Audit Metadata