ascii-video
Pass
Audited by Gen Agent Trust Hub on Mar 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The production pipeline uses
subprocess.runandsubprocess.Popento interface withffmpegandffprobefor video decoding, segment rendering, and final audio-video muxing. These commands are necessary for the skill's core purpose of media manipulation.\n- [EXTERNAL_DOWNLOADS]: The skill includes functionality to send text data to the ElevenLabs API (https://api.elevenlabs.io) to generate narrated audio clips. This represents an interaction with a well-known service for an intended feature (TTS integration) and is not indicative of unauthorized data exfiltration.\n- [PROMPT_INJECTION]: The skill processes user-supplied text from SRT subtitle files and quote lists (documented inreferences/inputs.md). While this provides an attack surface for indirect prompt injection, the risk is negligible as the data is used solely for rendering visual text art and generating narration, and the skill's capability inventory (subprocess calls for media processing) does not expose sensitive system functions. (Evidence: Ingestion points:references/inputs.md§ SRT Parsing; Capability inventory:references/scenes.md§ render_clip; Boundary markers and sanitization are absent, but the impact is limited by the rendering-specific context).
Audit Metadata