dubbing
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATION
Full Analysis
- [PRIVILEGE_ESCALATION]: The
scripts/check_deps.mjsfile contains logic to auto-installffmpegusing system package managers. On Linux systems, this involves executingsudo apt-get,sudo dnf, orsudo pacman, which requires elevated privileges. - [COMMAND_EXECUTION]: The skill uses
child_process.execFileandspawnto run external utilities includingffmpeg,ffprobe, andpowershell.exe. PowerShell is specifically used for DPAPI encryption/decryption of the API key on Windows inscripts/resolve_key.mjs. - [EXTERNAL_DOWNLOADS]: The
lib/input.mjsscript downloads media from user-supplied URLs to local temporary directories using thefetchAPI. - [DATA_EXFILTRATION]: Usage telemetry is sent to Amplitude (
api2.amplitude.com) vialib/telemetry.mjs. The data transmitted includes per-install UUIDs, account identifiers, and workspace metadata. While detailed, it is consistent with the commercial nature of the service. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources, including media files and subtitle (SRT) files from the Perso AI API. This data enters the agent context in
scripts/speaker.mjsfor speaker identification and text matching.
Audit Metadata