moviepy
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill identifies a surface for indirect prompt injection through its data ingestion methods, though this is expected for its media processing use case.
- Ingestion points: The skill processes external configuration data (such as the
products.jsonfile mentioned in Example 1) and scans local directories for video and audio files usingos.listdir(Step 7). - Boundary markers: There are no explicit delimiters or specific instructions for the agent to ignore potentially malicious instructions embedded within the processed data or media metadata.
- Capability inventory: The skill includes capabilities to write files to the local file system using
write_videofile,write_audiofile, andwrite_gifmethods across several scripts. - Sanitization: No specific content sanitization or validation logic is implemented for the external JSON data or media filenames being processed.
Audit Metadata