social-talking-head-video
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external URLs to generate webpage B-roll, creating a vulnerability to malicious instructions embedded in web content.\n
- Ingestion points: URLs provided by the user in the intake process (references/intake.md) or found during research are captured using Rollberry.\n
- Boundary markers: There are no specific instructions to use delimiters or to disregard instructions found within the captured webpage content.\n
- Capability inventory: The agent has access to shell execution (npx, ffmpeg, ffprobe) and file system operations.\n
- Sanitization: No sanitization or validation of the webpage content is performed before it is used for editorial planning.\n- [EXTERNAL_DOWNLOADS]: The skill utilizes npx to run and update external tools such as hyperframes and rollberry (from github.com/co-r-e/rollberry).\n- [COMMAND_EXECUTION]: The workflow requires executing multiple CLI tools for media analysis and video production. This includes the execution of ffprobe via a custom Python script (scripts/inventory_media.py) and various ffmpeg and npx commands for rendering and transcription.
Audit Metadata