video-use

Pass

Audited by Gen Agent Trust Hub on Aug 26, 2026

Risk Level: SAFE
Full Analysis
  • [DATA_EXPOSURE_AND_EXFILTRATION]: The skill manages the ELEVENLABS_API_KEY by instructing the user to store it in a .env file at the repository root. This follows secure development practices by avoiding hardcoded credentials and keeping secrets out of session-specific output directories.
  • [REMOTE_CODE_EXECUTION]: The skill utilizes well-known and widely used external tools including yt-dlp for downloading media and npx for executing established animation frameworks like HyperFrames and Remotion. These operations are restricted to specific installation and rendering tasks.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted external data in the form of video transcripts and footage.
  • Ingestion points: Raw Scribe transcripts (transcripts/*.json) and source video files provided by the user.
  • Boundary markers: The skill snap-aligns cuts to word boundaries and enforces a mandatory strategy confirmation phase ("Wait for confirmation") before any manipulation occurs.
  • Capability inventory: The skill has access to ffmpeg, PIL, npx, and the Agent tool for executing subprocesses and spawning animation sub-agents.
  • Sanitization: The skill relies on an explicit human-in-the-loop strategy proposal and approval step to validate the editor's plan before execution.
  • [DYNAMIC_EXECUTION]: The skill generates and runs scripts for animations using frameworks like HyperFrames, Remotion, and Manim. These are managed within isolated directory slots (edit/animations/slot_<id>/) and are generated based on specific technical templates for resolution, frame rate, and styling.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 26, 2026, 06:07 AM