product-launch-motion-v1

Pass

Audited by Gen Agent Trust Hub on Oct 15, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes several utility scripts (assemble.mjs, level-sfx.mjs, master.sh, verify-cue.sh) that invoke local system commands, specifically ffmpeg and ffprobe. These tools are used for necessary media processing tasks such as measuring narration length, normalizing audio levels, and encoding the final video output.
  • [EXTERNAL_DOWNLOADS]: The documentation references the use of npx hyperframes for performing automated quality assurance checks and generating frame snapshots. This involves downloading and running the hyperframes package from the NPM registry as part of the standard development and rendering workflow.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data inputs, including word-level transcripts (audio_meta.json) and cue tables (cues.json), to synchronize animations with audio. While this constitutes an attack surface for indirect injection via processed data, the data is used strictly as numeric or string parameters for animation timelines and foley events.
  • [DATA_EXPOSURE]: Multiple scripts perform file system read and write operations within the project directory to manage the assembly and mastering pipeline (e.g., generating index.html, reading film.json). These operations are scoped to local project assets and do not involve sensitive system files or credentials.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 15, 2026, 12:40 PM