ascii-video
Pass
Audited by Gen Agent Trust Hub on Apr 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
subprocessmodule to interface withffmpegandffprobefor essential media processing tasks such as decoding frames and encoding the final video output. These operations are well-documented and necessary for the skill's creative purpose.\n - Evidence:
subprocess.runandsubprocess.Popencalls are located throughoutreferences/inputs.mdandreferences/scenes.mdto manage video streams and audio extraction.\n- [EXTERNAL_DOWNLOADS]: Communicates with the ElevenLabs API using therequestslibrary to provide automated text-to-speech narration. This integration targets a well-known service and requires an API key provided by the user.\n - Evidence: The
generate_ttsfunction inreferences/inputs.mdhandles the interaction withapi.elevenlabs.io.\n- [PROMPT_INJECTION]: The skill processes user-supplied text data through SRT lyrics files, creating a theoretical surface for indirect prompt injection. However, as the content is processed for visual rendering, the risk to the agent is negligible.\n - Ingestion points:
references/inputs.mdparses external SRT files for the lyrics overlay mode.\n - Boundary markers: No specific delimiters or safety instructions are used when parsing text content.\n
- Capability inventory: The skill has access to command execution (ffmpeg) and network operations (ElevenLabs API).\n
- Sanitization: No sanitization is performed on the text data before it is rendered into character grids.\n- [SAFE]: The skill demonstrates a legitimate, high-quality architectural design for generative art. It uses a standard scientific Python stack and provides extensive optimization guidance (hardware detection, vectorized math) without any signs of malicious intent or obfuscation.
Audit Metadata