web-video-presentation
Warn
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The shell script
synthesize-audio.shuses thesourcecommand to load provider-specific logic from thescripts/tts-providers/directory based on thePRESENTATION_TTSenvironment variable or command-line arguments. This pattern of dynamic loading from computed paths is an execution surface. Additionally, the Node.js scriptextract-narrations.tsutilizes dynamicimport()to load generatednarrations.tsfiles from chapter directories during the build process. - [COMMAND_EXECUTION]: The skill automates project setup and validation by executing several external commands. The
scaffold.shscript runsnpm ciandnpm run check. Thecheck.mjsscript executesnpx tscto perform TypeScript validation. The TTS synthesis runner invokescurl,jq, and potentially external CLI tools such asffmpegormmx(MiniMax CLI) to process media. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided content from
plan.md(in YAML format) and.srtsubtitle files to generate code, documentation, and animation timing data. This ingestion of untrusted external data serves as a potential surface for influencing agent behavior. While the skill includes a defensivecheck.mjsscript to enforce design and code constraints, the structural ingestion of external text should be managed with caution. - [EXTERNAL_DOWNLOADS]: The skill fetches assets and interacts with well-known services. The
fonts.cssfile imports Google Fonts, and various TTS provider scripts (openai.sh,azure.sh,gcloud.sh) perform network requests to official APIs. These operations are essential for the skill's primary functions of media rendering and audio synthesis.
Audit Metadata