video-production
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes Python scripts (
package.py,review.py, andtranscribe.py) to execute local command-line tools such asffmpeg,ffprobe, and transcription runners. These commands are used for media analysis, audio extraction, and synchronization. The implementation avoids shell execution and uses strictly validated file paths to prevent command injection. - [EXTERNAL_DOWNLOADS]: The documentation provides references to well-known external tools and models, including NVIDIA's Parakeet (via Hugging Face), Remotion, and HeyGen's HyperFrames. These are well-established resources in the video technology sector. The skill does not automate the download or execution of these tools at runtime, requiring the user to set them up in their own local environment.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests transcription output and media metadata, which constitutes an attack surface for indirect prompt injection if the source content contains malicious instructions. The risk is classified as low because the skill includes technical validation for media formats and explicit instructions for the AI agent to evaluate all transcribed content within its editorial context rather than following it as direct instruction.
Audit Metadata