music-to-video
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs audio analysis using well-known Python libraries (librosa, numpy, soundfile) and orchestrates project assembly using Node.js. No suspicious network operations or unauthorized file access patterns were found in the scripts.
- [SAFE]: External dependencies such as GSAP, Three.js, and Google Fonts are loaded from established, well-known CDNs (jsDelivr, Google Fonts). This is standard practice for web-based rendering components and is considered safe.
- [SAFE]: Command execution within
scripts/analyze-beatgrid.pyfor calling FFmpeg is implemented securely using the argument list format ofsubprocess.run, which effectively prevents shell injection vulnerabilities. - [SAFE]: The skill includes defensive programming in its templates, specifically a dedicated SVG sanitization function (
cleanSvg) that uses an allow-list of tags and attributes to prevent DOM-based XSS when processing custom user-supplied icons.
Audit Metadata