video-toolkit

Pass

Audited by Gen Agent Trust Hub on Sep 12, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied text from project configuration files and markdown scripts to generate audio voiceovers, images, and video clips via various AI tools. This creates an indirect injection surface where malicious instructions in the content could influence tool behavior.
  • Ingestion points: Processes content from projects/PROJECT_NAME/src/config/demo-config.ts and projects/PROJECT_NAME/VOICEOVER-SCRIPT.md.
  • Boundary markers: No specific boundary markers or delimiters are instructed to isolate user content from the internal command structure of the tools.
  • Capability inventory: The environment has shell execution capabilities (npm, npx), local script execution (python3 tools/*.py), and network access to cloud GPU providers.
  • Sanitization: The instructions do not detail any sanitization or validation of the input text before it is interpolated into tool arguments.
  • [DYNAMIC_EXECUTION]: The toolkit utilizes modal deploy to send local Python code (docker/modal-*/app.py) to cloud environments for remote execution. Additionally, it executes React-based compositions dynamically through npx remotion still and npm run render to generate frames and final video files.
  • [COMMAND_EXECUTION]: The skill relies on extensive shell command execution for its operational workflow. This includes dependency installation using pip3 (with the --break-system-packages flag for system-managed environments) and npm, as well as media processing with ffprobe for timing analysis.
  • [EXTERNAL_DOWNLOADS]: The skill manages the installation of necessary dependencies from established registries, including the modal Python package and various Remotion-related Node.js modules. It also facilitates the retrieval of model assets from HuggingFace, which is a recognized and trusted source for machine learning components.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 12, 2026, 01:57 AM