dubbing

Pass

Audited by Gen Agent Trust Hub on Oct 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATION
Full Analysis
  • [PRIVILEGE_ESCALATION]: The scripts/check_deps.mjs file contains logic to auto-install ffmpeg using system package managers. On Linux systems, this involves executing sudo apt-get, sudo dnf, or sudo pacman, which requires elevated privileges.
  • [COMMAND_EXECUTION]: The skill uses child_process.execFile and spawn to run external utilities including ffmpeg, ffprobe, and powershell.exe. PowerShell is specifically used for DPAPI encryption/decryption of the API key on Windows in scripts/resolve_key.mjs.
  • [EXTERNAL_DOWNLOADS]: The lib/input.mjs script downloads media from user-supplied URLs to local temporary directories using the fetch API.
  • [DATA_EXFILTRATION]: Usage telemetry is sent to Amplitude (api2.amplitude.com) via lib/telemetry.mjs. The data transmitted includes per-install UUIDs, account identifiers, and workspace metadata. While detailed, it is consistent with the commercial nature of the service.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources, including media files and subtitle (SRT) files from the Perso AI API. This data enters the agent context in scripts/speaker.mjs for speaker identification and text matching.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 18, 2026, 06:34 PM