video-production

Warn

Audited by Gen Agent Trust Hub on Oct 16, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: Multiple Python scripts in the vendor directory, such as gates/aggregate.py, tools/fetch_sfx.py, and tools/transcode_material.py, utilize the subprocess module to run shell commands for FFmpeg, FFprobe, and curl operations.
  • [DYNAMIC_EXECUTION]: The orchestration logic in vendor/video-pipeline-sdk/pipeline/run.py and the quality gate aggregator in vendor/video-pipeline-sdk/gates/aggregate.py permit the execution of arbitrary command strings retrieved from JSON state and configuration files.
  • [EXTERNAL_DOWNLOADS]: The skill automates the retrieval of media assets from mixkit.co and machine learning model files from Hugging Face Mirror (hf-mirror.com).
  • [PRIVILEGE_ESCALATION]: Setup documentation and the deps/bootstrap.ps1 script direct users to run PowerShell with the -ExecutionPolicy Bypass flag, circumventing standard security restrictions.
  • [INDIRECT_PROMPT_INJECTION]: The pipeline ingests untrusted transcripts and markdown design tables which are used to determine scene structure and automate production, creating a surface for indirect prompt injection that could influence the agent's automated workflow.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 16, 2026, 04:23 AM