multilingual-dubbing
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data via a JSON storyboard file, which is a common attack surface for indirect prompt injection.
- Ingestion points: storyboard.json is read and parsed in scripts/assemble.py to drive video generation.
- Boundary markers: No specific delimiters or safety instructions are present in the storyboard data format.
- Capability inventory: The skill utilizes subprocess calls to execute ffmpeg and ffprobe for video assembly and metadata extraction.
- Sanitization: The implementation uses list-based arguments for subprocess.run and subprocess.check_output, effectively preventing standard shell command injection attacks.- [EXTERNAL_DOWNLOADS]: The skill makes network requests to fetch audio data from a well-known service.
- Fetches voice-over audio from Microsoft Edge's public TTS service via the edge-tts library in scripts/tts_edge.py.
Audit Metadata