video-scriptwriter

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes a local utility script, scripts/measure.py, which invokes the ffprobe command-line tool.
  • The script uses subprocess.run with a list of arguments to call ffprobe, which is a secure method of executing external binaries that prevents shell injection.
  • The utility is used specifically for measuring audio duration and extracting metadata for project synchronization.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external text data such as voice transcripts, dictated chat, and user-provided scripts, which introduces an indirect prompt injection surface.
  • The skill instructions explicitly direct the agent to treat transcripts as 'evidence, not authority' and to perform manual context checks to resolve recognition errors.
  • The use of <!-- narration:start --> and <!-- narration:end --> boundary markers in Markdown files helps the agent distinguish between spoken content and potential instruction blocks.
  • [DYNAMIC_EXECUTION]: The scripts/measure.py script performs runtime analysis of files within the project environment.
  • It reads file contents to calculate SHA-256 hashes for integrity receipts and uses the wave library or ffprobe for audio inspection.
  • The script includes input validation and error handling for file paths and numerical values.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 04:39 AM
Security Audit — agent-trust-hub — video-scriptwriter