sn-motion-html
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Several Python scripts in the project use subprocess to invoke ffmpeg and ffprobe. These tools are used for standard media tasks like normalization, frame extraction, and validation. The scripts cast numeric manifest values (resolution, framerate) to their appropriate types before use, significantly reducing the risk of command injection.
- [EXTERNAL_DOWNLOADS]: The seedance_pipeline.py script makes requests to the official ByteDance Volcengine Ark API (ark.cn-beijing.volces.com) to generate and download video content. This is a core feature of the skill and utilizes a well-known service provider.
- [CREDENTIALS_UNSAFE]: The skill relies on an API key stored in a local .env file. It follows security best practices by providing a template for secrets, instructing users to exclude the file from version control, and including a development server (serve_project.py) that explicitly denies access to hidden files to prevent exposure.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied narrative and prompt data. To mitigate risks associated with untrusted content, the workflow enforces explicit user approval gates for the visual style, content plan, and final video generation before any external API calls or large-scale processing occurs.
Audit Metadata