ppt-avatar-video
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes several command-line tools for media processing and file management. Evidence includes the use of
ffmpegandffprobewithin the provided scripts for metadata and alpha channel analysis, as well as theokouCLI for deck rasterization and narration generation. - [EXTERNAL_DOWNLOADS]: Fetches external resources and tools required for video production. It utilizes
npxto download and execute thehyperframespackage from the NPM registry and usesokou web download-fileto retrieve user-provided documents. - [DYNAMIC_EXECUTION]: Executes local utility scripts to handle complex video composition logic at runtime. This includes
build-project.mjsfor manifest generation andprobe-alpha-bbox.mjsfor calculating visual boundaries in avatar videos. - [INDIRECT_PROMPT_INJECTION]: The skill processes text from user-provided slide content and speaker notes to generate narration scripts. Ingestion points: Extracts text from PPT/PDF files and user-supplied scripts. Boundary markers: No explicit boundary markers are used when interpolating extracted text into narration commands. Capability inventory: Includes file system access for project staging and subprocess execution for media encoding. Sanitization: Implements path validation in
build-project.mjsto prevent directory traversal and pipes narration data via standard input to avoid shell injection.
Audit Metadata