pr-to-video — security audits

Review recommended

Independent security partners scan this skill's files for malicious content, prompt injection and risky patterns. Verdicts below come from the skills.sh audit program; each partner links to its full report.

• Gen Agent Trust Hub

  pass

  The skill 'pr-to-video' automates the creation of video explainers from GitHub pull requests. It utilizes the GitHub CLI and custom scripts to ingest PR metadata, generate narration, and render visual compositions. The skill includes security-focused features like SSRF guards for asset downloads and input sanitization for PR descriptions. A minor risk of indirect prompt injection exists because the skill processes untrusted user content from pull requests to derive storyboards and scripts.

  Risk: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSJul 29, 2026Full report

• Socket

  warn

  2 alerts: gptAnomaly

  Jul 29, 2026Full report

• Snyk

  warn

  Risk: MEDIUM · 2 issues

  Risk: MEDIUMJul 29, 2026Full report