spoken-captions

Pass

Audited by Gen Agent Trust Hub on Oct 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses python3 scripts/reel_text.py to calculate caption timings. The script is included in the skill package, uses only the Python standard library, and performs safe JSON processing without shell injection risks or external network calls.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided transcripts and scene data. While these are ingestion points for external data, the reel_text.py script treats this data as strictly structured JSON for geometry and timing calculations. It does not interpolate this data back into LLM prompts in a way that could trigger instruction override, and it focuses on rendering text onto video layers.
  • [REMOTE_CODE_EXECUTION]: No remote code execution patterns were detected. All logic is contained within the provided local script.
  • [DATA_EXFILTRATION]: No network operations or sensitive file access patterns were found. The script operates entirely offline and only prints the modified scene JSON to standard output.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 30, 2026, 02:44 PM