ascii-video

Pass

Audited by Gen Agent Trust Hub on Apr 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the subprocess module to interface with ffmpeg and ffprobe for essential media processing tasks such as decoding frames and encoding the final video output. These operations are well-documented and necessary for the skill's creative purpose.\n
  • Evidence: subprocess.run and subprocess.Popen calls are located throughout references/inputs.md and references/scenes.md to manage video streams and audio extraction.\n- [EXTERNAL_DOWNLOADS]: Communicates with the ElevenLabs API using the requests library to provide automated text-to-speech narration. This integration targets a well-known service and requires an API key provided by the user.\n
  • Evidence: The generate_tts function in references/inputs.md handles the interaction with api.elevenlabs.io.\n- [PROMPT_INJECTION]: The skill processes user-supplied text data through SRT lyrics files, creating a theoretical surface for indirect prompt injection. However, as the content is processed for visual rendering, the risk to the agent is negligible.\n
  • Ingestion points: references/inputs.md parses external SRT files for the lyrics overlay mode.\n
  • Boundary markers: No specific delimiters or safety instructions are used when parsing text content.\n
  • Capability inventory: The skill has access to command execution (ffmpeg) and network operations (ElevenLabs API).\n
  • Sanitization: No sanitization is performed on the text data before it is rendered into character grids.\n- [SAFE]: The skill demonstrates a legitimate, high-quality architectural design for generative art. It uses a standard scientific Python stack and provides extensive optimization guidance (hardware detection, vectorized math) without any signs of malicious intent or obfuscation.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 27, 2026, 07:07 AM