whiteboard-video-workflow
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied SRT subtitle files through a subagent specified in
references/storyboard-parser.md. This creates a surface where instructions embedded within the subtitles could attempt to influence the agent's behavior during the semantic grouping or image prompt generation phases. - Ingestion points: The
srtPathfile is read and analyzed by the agent in Step 3. - Boundary markers: The instructions do not define clear boundary markers or provide the agent with directives to ignore instructions contained within the SRT content.
- Capability inventory: The skill and its subagents have capabilities for file reading/writing and local script execution.
- Sanitization: There is no evidence of sanitization or filtering of the subtitle text before it is used for semantic analysis.
- [COMMAND_EXECUTION]: The workflow relies on the execution of multiple Python scripts to orchestrate the process. For instance,
scripts/check_env.pyusessubprocess.runto invoke environment setup scripts, andscripts/workflow_helper.pyis called repeatedly for directory initialization and video merging. This orchestration is standard for complex local workflows but involves significant shell command execution. - [EXTERNAL_DOWNLOADS]: The
scripts/generate-image.pyscript makes network requests to the RunningHub API (www.runninghub.cn) to generate content and downloads resulting image files to the local workspace usingurllib.request.
Audit Metadata