video-production

Pass

Audited by Gen Agent Trust Hub on Sep 11, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the video-studio-engine package directly from a GitHub repository archive and utilizes the @scrollmark/cli tool. These external resources are managed through standard package managers (pip and npx) and are hosted within the official ecosystem of the skill's author.
  • [COMMAND_EXECUTION]: Multiple bundled Python utility scripts (doctor.py, normalize_audio.py, poster.py, and qc_render.py) utilize the subprocess module to execute system commands. These operations are strictly directed at media processing utilities like ffmpeg and ffprobe, or the project's own video-studio command-line interface, to perform tasks such as audio normalization, frame extraction, and render validation.
  • [INDIRECT_PROMPT_INJECTION]: The skill's workflow involves ingesting and processing data from external and potentially untrusted sources, including user-provided URLs, local files, and generated media prompts. This ingestion creates a theoretical surface for indirect prompt injection where malicious instructions could be embedded in media metadata or source content.
  • Ingestion points: Step 3 of the pipeline acquires footage and audio from diverse sources including url: and file: paths defined in the storyboard.
  • Boundary markers: The engine uses a structured JSON schema for storyboards and plans to isolate instructions from data, and requires explicit user approval before installations or major pipeline steps.
  • Capability inventory: The skill possesses capabilities for file system writes to project directories, shell command execution for media processing, and network access for asset sourcing.
  • Sanitization: Validation is primarily handled by the underlying video-studio engine and ffmpeg filters, supplemented by mandatory human-in-the-loop review phases (Step 8) for quality control.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 11, 2026, 12:58 PM