make-video

Pass

Audited by Gen Agent Trust Hub on Nov 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a bundled shell script (scripts/new-film.sh) to scaffold project directories, create configuration files, and establish project-specific house rules for the agent.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of third-party video engines and tools using npx skills add. This includes dependencies from repositories such as remotion-dev/skills, heygen-com/hyperframes, and mirage-hq/Tesseract. The documentation explicitly notes that some tools may download proprietary binaries or external assets.
  • [INDIRECT_PROMPT_INJECTION]: The workflow ingests user-provided briefs and external assets (screens, logos, colors). It mitigates risks associated with untrusted data by implementing a multi-stage production pipeline with mandatory "gates" and manual review checkpoints between every phase.
  • [DATA_EXFILTRATION]: The skill documentation provides transparency regarding data flow, noting that specific third-party tools (HyperFrames) may transmit frame data to external AI services (Google Gemini) if API keys are configured. It provides remediation instructions (--describe false) to maintain privacy for sensitive material.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 9, 2026, 03:32 PM