motion-reel
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
ffmpegandffprobeviasubprocess.runinfinish.pyandspawninrender.mjsto process video frames, mix audio, and generate review sheets. These calls use argument lists rather than shell strings, which is a secure implementation for executing system binaries. - [EXTERNAL_DOWNLOADS]: The skill requires standard project dependencies including the
playwrightNode.js package and its associated Chromium browser binaries. It also mentions optional Python packages for audio analysis (librosa,numpy,soundfile) which are well-known libraries in the data science community. - [INDIRECT_PROMPT_INJECTION]: The workflow requires the agent to visit user-provided URLs and inspect reference images or videos. This constitutes an ingestion surface for untrusted external data that is then processed by the agent and media tools.
- Ingestion points: External product URLs and reference media files specified in the
SKILL.mdworkflow. - Boundary markers: The instructions do not define specific delimiters for untrusted data but encourage manual review of all assets.
- Capability inventory: The skill possesses the ability to write to the local file system, execute media processing commands, and perform browser automation.
- Sanitization: The skill relies on the underlying media tools (FFmpeg) and browser engines to handle data formats safely without explicit sanitization logic in the skill's own scripts.
Audit Metadata