product-launch-motion-v1
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill includes several utility scripts (
assemble.mjs,level-sfx.mjs,master.sh,verify-cue.sh) that invoke local system commands, specificallyffmpegandffprobe. These tools are used for necessary media processing tasks such as measuring narration length, normalizing audio levels, and encoding the final video output. - [EXTERNAL_DOWNLOADS]: The documentation references the use of
npx hyperframesfor performing automated quality assurance checks and generating frame snapshots. This involves downloading and running thehyperframespackage from the NPM registry as part of the standard development and rendering workflow. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data inputs, including word-level transcripts (
audio_meta.json) and cue tables (cues.json), to synchronize animations with audio. While this constitutes an attack surface for indirect injection via processed data, the data is used strictly as numeric or string parameters for animation timelines and foley events. - [DATA_EXPOSURE]: Multiple scripts perform file system read and write operations within the project directory to manage the assembly and mastering pipeline (e.g., generating
index.html, readingfilm.json). These operations are scoped to local project assets and do not involve sensitive system files or credentials.
Audit Metadata