ppt-avatar-video

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes several command-line tools for media processing and file management. Evidence includes the use of ffmpeg and ffprobe within the provided scripts for metadata and alpha channel analysis, as well as the okou CLI for deck rasterization and narration generation.
  • [EXTERNAL_DOWNLOADS]: Fetches external resources and tools required for video production. It utilizes npx to download and execute the hyperframes package from the NPM registry and uses okou web download-file to retrieve user-provided documents.
  • [DYNAMIC_EXECUTION]: Executes local utility scripts to handle complex video composition logic at runtime. This includes build-project.mjs for manifest generation and probe-alpha-bbox.mjs for calculating visual boundaries in avatar videos.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes text from user-provided slide content and speaker notes to generate narration scripts. Ingestion points: Extracts text from PPT/PDF files and user-supplied scripts. Boundary markers: No explicit boundary markers are used when interpolating extracted text into narration commands. Capability inventory: Includes file system access for project staging and subprocess execution for media encoding. Sanitization: Implements path validation in build-project.mjs to prevent directory traversal and pipes narration data via standard input to avoid shell injection.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 01:24 AM
Security Audit — agent-trust-hub — ppt-avatar-video