music-to-video
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes command-line utilities to perform its core functions. It executes
ffmpegfor audio decoding and normalization,python3for beat-grid analysis, and thehyperframesCLI for project initialization and rendering. These commands are executed locally within the project environment and are essential for the video generation process. - [EXTERNAL_DOWNLOADS]: The skill instructions facilitate the installation of industry-standard Python libraries including
librosa,numpy, andsoundfilefrom official registries. It also loads common frontend libraries such as GSAP and Three.js, along with fonts, from established and well-known content delivery networks (jsDelivr and Google Fonts). - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted music files and user-supplied assets, creating a potential surface for indirect instruction through file metadata or file paths.
- Ingestion points: The audio analyzer (
analyze-beatgrid.py) reads external music tracks to generate a timing map, and the storyboard parser (storyboard.mjs) processes asset paths provided by the user. - Boundary markers: The workflow implements a robust human-in-the-loop checkpoint system. Step 3 (Plan approval) and Step 6 (Render approval) explicitly require user verification before the agent proceeds to high-capability tasks like full video rendering.
- Capability inventory: The skill scripts perform local file operations and execute subprocesses to coordinate the project assembly and rendering.
- Sanitization: Complex input parsing is delegated to established technical libraries (FFmpeg and Librosa) which perform validation of media file integrity and structures.
Audit Metadata