making-content

Pass

Audited by Gen Agent Trust Hub on Oct 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill automates the retrieval of development assets from established and trusted platforms.
  • It fetches fonts from Google Fonts (fonts.googleapis.com).
  • It retrieves project logos and avatars from GitHub (github.com, avatars.githubusercontent.com).
  • It downloads royalty-free music from Incompetech (incompetech.com).
  • It utilizes cloud-based TTS services from Microsoft Edge and Volcengine (Bytedance).
  • [COMMAND_EXECUTION]: Several Python scripts (render.py, timeline.py) utilize subprocess to interface with standard media processing tools like ffmpeg and ffprobe. This is the intended primary purpose of the skill to perform video compositing and audio mixing.
  • [DATA_EXPOSURE]: The skill includes instructions for handling API keys (specifically for Volcengine TTS). It explicitly mandates using environment variables and warns against hardcoding secrets in files, scripts, or commits. It also suggests revoking temporary keys after use.
  • [DYNAMIC_EXECUTION]: The pipeline uses Playwright (capture.py, lint.py, render.py) to render HTML templates into images and video frames. This is a local-only operation for generating visual content based on user-provided drafts.
  • [SAFE]: Static analysis hints regarding subprocess usage in scripts/timeline.py and scripts/render.py are confirmed as benign, as they are used to invoke standard system utilities for media rendering according to the skill's stated purpose.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 30, 2026, 09:32 AM