video-production
Pass
Audited by Gen Agent Trust Hub on Nov 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on a suite of local scripts (
make.py,init-project.sh) and specialized utilities in thetalking-head/scripts/directory to manage the video production workflow. These scripts use thesubprocessmodule to execute system commands and interface with external binaries includingffmpeg,magick(ImageMagick), and proprietary CLI tools such asflowandfilmcraft-cli. - [EXTERNAL_DOWNLOADS]: The instructions direct the agent to clone a support tool (
review-board) from the author's official GitHub repository (https://github.com/niiithish/review-board) if it is not already present in the workspace. This is a vendor-provided resource used for reviewing generated media. - [INDIRECT_PROMPT_INJECTION]: The production pipeline ingests and processes data from external files such as
PLAN.mdand various JSON manifests (stills-batch.json,clips-batch.json). These files act as the control logic for the automated scripts, defining shot sequences, prompts, and timing, which represents a potential attack surface for indirect instruction injection.
Audit Metadata