music-to-video

Pass

Audited by Gen Agent Trust Hub on Sep 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes command-line utilities to perform its core functions. It executes ffmpeg for audio decoding and normalization, python3 for beat-grid analysis, and the hyperframes CLI for project initialization and rendering. These commands are executed locally within the project environment and are essential for the video generation process.
  • [EXTERNAL_DOWNLOADS]: The skill instructions facilitate the installation of industry-standard Python libraries including librosa, numpy, and soundfile from official registries. It also loads common frontend libraries such as GSAP and Three.js, along with fonts, from established and well-known content delivery networks (jsDelivr and Google Fonts).
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted music files and user-supplied assets, creating a potential surface for indirect instruction through file metadata or file paths.
  • Ingestion points: The audio analyzer (analyze-beatgrid.py) reads external music tracks to generate a timing map, and the storyboard parser (storyboard.mjs) processes asset paths provided by the user.
  • Boundary markers: The workflow implements a robust human-in-the-loop checkpoint system. Step 3 (Plan approval) and Step 6 (Render approval) explicitly require user verification before the agent proceeds to high-capability tasks like full video rendering.
  • Capability inventory: The skill scripts perform local file operations and execute subprocesses to coordinate the project assembly and rendering.
  • Sanitization: Complex input parsing is delegated to established technical libraries (FFmpeg and Librosa) which perform validation of media file integrity and structures.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 26, 2026, 07:50 PM