hve-spielberg
Fail
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: Provides instructions to download and execute a requirements check script from the author's repository. The script content is included in the skill for inspection.
- [REMOTE_CODE_EXECUTION]: Python scripts automatically attempt to install the 'requests' library via the system package manager if it is missing.
- [COMMAND_EXECUTION]: Extensively uses subprocess calls to execute media processing tools such as ffmpeg, ffprobe, and asciinema.
- [EXTERNAL_DOWNLOADS]: Fetches configuration and media assets from established services including ElevenLabs, Freesound, and the jsDelivr CDN.
- [PROMPT_INJECTION]: Implements a capture workflow that uses project descriptions and metadata to generate shell commands for terminal recording, which represents an indirect prompt injection surface.
- [PROMPT_INJECTION]: Includes a mock review file (REVIEW.md) with self-referential security claims that are treated as informational data and do not influence the final verdict.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/nebrass/hve-spielberg/main/scripts/check_requirements.sh - DO NOT USE without thorough review
Audit Metadata