video-scriptwriter
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a local utility script,
scripts/measure.py, which invokes theffprobecommand-line tool. - The script uses
subprocess.runwith a list of arguments to callffprobe, which is a secure method of executing external binaries that prevents shell injection. - The utility is used specifically for measuring audio duration and extracting metadata for project synchronization.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external text data such as voice transcripts, dictated chat, and user-provided scripts, which introduces an indirect prompt injection surface.
- The skill instructions explicitly direct the agent to treat transcripts as 'evidence, not authority' and to perform manual context checks to resolve recognition errors.
- The use of
<!-- narration:start -->and<!-- narration:end -->boundary markers in Markdown files helps the agent distinguish between spoken content and potential instruction blocks. - [DYNAMIC_EXECUTION]: The
scripts/measure.pyscript performs runtime analysis of files within the project environment. - It reads file contents to calculate SHA-256 hashes for integrity receipts and uses the
wavelibrary orffprobefor audio inspection. - The script includes input validation and error handling for file paths and numerical values.
Audit Metadata