video-use
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill manages the
ELEVENLABS_API_KEYby instructing the user to store it in a.envfile at the repository root. This follows secure development practices by avoiding hardcoded credentials and keeping secrets out of session-specific output directories. - [REMOTE_CODE_EXECUTION]: The skill utilizes well-known and widely used external tools including
yt-dlpfor downloading media andnpxfor executing established animation frameworks like HyperFrames and Remotion. These operations are restricted to specific installation and rendering tasks. - [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted external data in the form of video transcripts and footage.
- Ingestion points: Raw Scribe transcripts (
transcripts/*.json) and source video files provided by the user. - Boundary markers: The skill snap-aligns cuts to word boundaries and enforces a mandatory strategy confirmation phase ("Wait for confirmation") before any manipulation occurs.
- Capability inventory: The skill has access to
ffmpeg,PIL,npx, and theAgenttool for executing subprocesses and spawning animation sub-agents. - Sanitization: The skill relies on an explicit human-in-the-loop strategy proposal and approval step to validate the editor's plan before execution.
- [DYNAMIC_EXECUTION]: The skill generates and runs scripts for animations using frameworks like HyperFrames, Remotion, and Manim. These are managed within isolated directory slots (
edit/animations/slot_<id>/) and are generated based on specific technical templates for resolution, frame rate, and styling.
Audit Metadata