product-video

Pass

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run and spawn to invoke standard media processing tools and internal helper scripts. This includes ffmpeg for video assembly, ffprobe for media analysis, and node to execute the skill's own automation scripts for crawling (crawl.mjs) and recording (record.mjs). These operations are restricted to the skill's defined media workflow.
  • [EXTERNAL_DOWNLOADS]: Network requests are performed to fetch website data for crawling and to interact with the ElevenLabs API for generating voices and music. The ElevenLabs interaction is handled through established official endpoints (api.elevenlabs.io) using user-provided authentication.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external websites to produce video content.
  • Ingestion points: Untrusted website content is fetched by scripts/crawl.mjs and stored in site.json for processing.
  • Boundary markers: User review of the 'animatic' stills is required before rendering, and the skill performs automated checks to ensure on-screen text strictly matches the source website's original copy.
  • Capability inventory: The skill possesses capabilities for file system access, network communication, and media-related command execution across its distributed scripts.
  • Sanitization: Robust sanitization is present, including text normalization and an 'auto-blur' privacy mechanism in record.mjs that redacts identified emails, names, and avatars from screen captures.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 14, 2026, 11:01 AM