music-to-video
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs standard Python packages (librosa, numpy, soundfile) from the PyPI registry and framework utilities from the npm registry using npx. Frontend components reference well-known CDN services like JSDelivr and Google Fonts for assets.
- [COMMAND_EXECUTION]: The skill workflow involves executing ffmpeg for audio transcoding and uses various hyperframes CLI utilities for project initialization and video rendering. These operations are conducted using safe subprocess methods and are core to the skill's documented functionality.
- [INDIRECT_PROMPT_INJECTION]: The skill processes project briefs and user-supplied lyrics. 1. Ingestion points: BRIEF.md and the user input stream. 2. Boundary markers: Absent. 3. Capability inventory: Subprocess calls to ffmpeg and file system writes for project files. 4. Sanitization: Absent. This data ingestion is the intended purpose of the skill and no adversarial exploitation was identified.
Audit Metadata