make-video
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a bundled shell script (
scripts/new-film.sh) to scaffold project directories, create configuration files, and establish project-specific house rules for the agent. - [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of third-party video engines and tools using
npx skills add. This includes dependencies from repositories such asremotion-dev/skills,heygen-com/hyperframes, andmirage-hq/Tesseract. The documentation explicitly notes that some tools may download proprietary binaries or external assets. - [INDIRECT_PROMPT_INJECTION]: The workflow ingests user-provided briefs and external assets (screens, logos, colors). It mitigates risks associated with untrusted data by implementing a multi-stage production pipeline with mandatory "gates" and manual review checkpoints between every phase.
- [DATA_EXFILTRATION]: The skill documentation provides transparency regarding data flow, noting that specific third-party tools (HyperFrames) may transmit frame data to external AI services (Google Gemini) if API keys are configured. It provides remediation instructions (
--describe false) to maintain privacy for sensitive material.
Audit Metadata