video-production
Warn
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Multiple Python scripts in the vendor directory, such as
gates/aggregate.py,tools/fetch_sfx.py, andtools/transcode_material.py, utilize the subprocess module to run shell commands for FFmpeg, FFprobe, and curl operations. - [DYNAMIC_EXECUTION]: The orchestration logic in
vendor/video-pipeline-sdk/pipeline/run.pyand the quality gate aggregator invendor/video-pipeline-sdk/gates/aggregate.pypermit the execution of arbitrary command strings retrieved from JSON state and configuration files. - [EXTERNAL_DOWNLOADS]: The skill automates the retrieval of media assets from
mixkit.coand machine learning model files from Hugging Face Mirror (hf-mirror.com). - [PRIVILEGE_ESCALATION]: Setup documentation and the
deps/bootstrap.ps1script direct users to run PowerShell with the-ExecutionPolicy Bypassflag, circumventing standard security restrictions. - [INDIRECT_PROMPT_INJECTION]: The pipeline ingests untrusted transcripts and markdown design tables which are used to determine scene structure and automate production, creating a surface for indirect prompt injection that could influence the agent's automated workflow.
Audit Metadata