Keynote Video

• Analyzed: May 10, 2026, 7:15 AM
• Findings: 1
• Version: 2.0.0
• Hash: 12843cf5a44b78e28d64773dbcec3c71246af319cea2dc468c7140965c83b7e2
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle implements a PPT-to-video conversion pipeline using a multi-phase approach involving LLM content generation and script-based technical synthesis. The primary security concern is the use of `child_process.execSync` in `scripts/generate.js` to invoke external tools like `ffmpeg`, `libreoffice`, and `edge-tts`. While the script includes an `escapeForShell` utility to sanitize inputs, the pattern of executing shell commands with data extracted from user-provided PPT files and LLM-generated scripts introduces a risk of shell injection. No evidence of intentional malicious behavior, data exfiltration, or unauthorized persistence was found, and the behavior aligns with the stated purpose.