brag
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches approximately 290 files, including music and SFX libraries, from the latent-spaces/brag repository via the GitHub contents API. It also references external skill dependencies from the HeyGen GitHub organization.
- [COMMAND_EXECUTION]: Invokes external system tools including FFmpeg and the Hyperframes CLI via npx to perform video rendering and composition.
- [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill reads the project in the current directory (referenced in SKILL.md) to determine video tone and storyboard angles.
- Boundary markers: No specific delimiters or "ignore instructions" warnings are documented for the ingested project data.
- Capability inventory: The skill can execute shell commands, run local Python scripts, and write files to the brag-output directory.
- Sanitization: No evidence of sanitization or filtering of the project data before it is processed by the AI model.
- [DYNAMIC_EXECUTION]: Utilizes the uv tool to run a local Python script (scripts/analyze_music_cues.py) for beat-sync analysis on custom audio tracks.
Audit Metadata