create-typecast-shorts
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the 'cast' CLI tool from the vendor's official GitHub repository (github.com/neosapience/cast) or Homebrew tap. These resources originate from the skill's author and are documented for intended functionality.
- [COMMAND_EXECUTION]: The skill utilizes several shell commands, including ffmpeg, ffprobe, and the vendor's cast tool, to perform media processing, narration generation, and video rendering. The instructions mandate quoting user-provided paths to prevent basic path injection.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied scripts and media, which represents a potential attack surface.
- Ingestion points: Topic or finished script and local media paths provided by the user (SKILL.md).
- Boundary markers: Explicit instructions to confirm media rights and obtain approval for the generated script before processing (SKILL.md).
- Capability inventory: Subprocess execution of ffmpeg, ffprobe, and cast (SKILL.md).
- Sanitization: Instructions specify quoting every user-provided path and returning local artifacts for user review rather than publishing them automatically (SKILL.md).
Audit Metadata