product-video
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runandspawnto invoke standard media processing tools and internal helper scripts. This includesffmpegfor video assembly,ffprobefor media analysis, andnodeto execute the skill's own automation scripts for crawling (crawl.mjs) and recording (record.mjs). These operations are restricted to the skill's defined media workflow. - [EXTERNAL_DOWNLOADS]: Network requests are performed to fetch website data for crawling and to interact with the ElevenLabs API for generating voices and music. The ElevenLabs interaction is handled through established official endpoints (
api.elevenlabs.io) using user-provided authentication. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external websites to produce video content.
- Ingestion points: Untrusted website content is fetched by
scripts/crawl.mjsand stored insite.jsonfor processing. - Boundary markers: User review of the 'animatic' stills is required before rendering, and the skill performs automated checks to ensure on-screen text strictly matches the source website's original copy.
- Capability inventory: The skill possesses capabilities for file system access, network communication, and media-related command execution across its distributed scripts.
- Sanitization: Robust sanitization is present, including text normalization and an 'auto-blur' privacy mechanism in
record.mjsthat redacts identified emails, names, and avatars from screen captures.
Audit Metadata