hologram-presenter-video
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
subprocess.runmodule inscripts/concat_videos.pyto invokeffmpegandffprobefor merging video segments and probing file metadata. The implementation follows security best practices by using list-based arguments rather than shell strings and includes internal checks to ensure that input paths are relative, mitigating potential command injection or directory traversal risks. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided content and images to generate scripts and video prompts, which is a potential surface for indirect prompt injection.
- Ingestion points: External text content and local images are ingested during the Profile and Scripting stages in
SKILL.md. - Boundary markers: The skill employs a strict four-stage 'Gate' system (Gate 0 to Gate 3), requiring explicit user confirmation at each transition to verify generated content before proceeding to external API calls.
- Capability inventory: The skill has the ability to write project files, execute local scripts via
python3, and call external video generation tools. - Sanitization: Path validation is performed in the utility scripts to ensure all file operations remain within the designated project directories.
Audit Metadata