demo-video-pipeline
Pass
Audited by Gen Agent Trust Hub on May 9, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
ffmpegfor video transcoding and audio mixing. Execution is handled viaexecFileSyncin TypeScript and standard bash commands in shell scripts. These operations are essential for the skill's primary function of video production and use hardcoded or local file path arguments. - [EXTERNAL_DOWNLOADS]: Dependencies are managed through standard package managers (pnpm/npm). The skill instructs the installation of well-known libraries such as Playwright and Remotion from official registries. Browsers are installed using the official Playwright CLI.
- [CREDENTIALS_UNSAFE]: The skill documentation mentions the use of API keys for ElevenLabs and OpenAI. It correctly advises users to manage these via environment variables rather than hardcoding them into scripts.
- [REMOTE_CODE_EXECUTION]: No patterns of unsafe remote code execution (such as
curl | bash) were identified. The logic relies on locally stored scripts and verified third-party libraries.
Audit Metadata