batch-lipsync

Pass

Audited by Gen Agent Trust Hub on Nov 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/sync_batch.py script uses subprocess.run to call ffprobe for retrieving media metadata. This is a functional requirement used to calculate media durations for cost estimation and manifest validation, and it is limited to specific non-shell commands.
  • [EXTERNAL_DOWNLOADS]: The skill performs network operations to upload source media and download generated videos. These operations are conducted using pre-signed URLs and the official API for sync.so (the vendor), which is the intended core functionality of the skill.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data from CSV files and local directories to build generation manifests. While this represents an ingestion point for untrusted data, the skill mitigates risks through explicit instruction to the agent for manual manifest review, ID validation via regular expressions, and recommendations for 'pilot' runs to verify outputs before processing large batches.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 5, 2026, 01:14 PM