video-production

Pass

Audited by Gen Agent Trust Hub on Nov 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill relies on a suite of local scripts (make.py, init-project.sh) and specialized utilities in the talking-head/scripts/ directory to manage the video production workflow. These scripts use the subprocess module to execute system commands and interface with external binaries including ffmpeg, magick (ImageMagick), and proprietary CLI tools such as flow and filmcraft-cli.
  • [EXTERNAL_DOWNLOADS]: The instructions direct the agent to clone a support tool (review-board) from the author's official GitHub repository (https://github.com/niiithish/review-board) if it is not already present in the workspace. This is a vendor-provided resource used for reviewing generated media.
  • [INDIRECT_PROMPT_INJECTION]: The production pipeline ingests and processes data from external files such as PLAN.md and various JSON manifests (stills-batch.json, clips-batch.json). These files act as the control logic for the automated scripts, defining shot sequences, prompts, and timing, which represents a potential attack surface for indirect instruction injection.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 12, 2026, 05:02 AM