skills/alesha-pro/tools/motion-reel/Gen Agent Trust Hub

motion-reel

Pass

Audited by Gen Agent Trust Hub on Sep 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes ffmpeg and ffprobe via subprocess.run in finish.py and spawn in render.mjs to process video frames, mix audio, and generate review sheets. These calls use argument lists rather than shell strings, which is a secure implementation for executing system binaries.
  • [EXTERNAL_DOWNLOADS]: The skill requires standard project dependencies including the playwright Node.js package and its associated Chromium browser binaries. It also mentions optional Python packages for audio analysis (librosa, numpy, soundfile) which are well-known libraries in the data science community.
  • [INDIRECT_PROMPT_INJECTION]: The workflow requires the agent to visit user-provided URLs and inspect reference images or videos. This constitutes an ingestion surface for untrusted external data that is then processed by the agent and media tools.
  • Ingestion points: External product URLs and reference media files specified in the SKILL.md workflow.
  • Boundary markers: The instructions do not define specific delimiters for untrusted data but encourage manual review of all assets.
  • Capability inventory: The skill possesses the ability to write to the local file system, execute media processing commands, and perform browser automation.
  • Sanitization: The skill relies on the underlying media tools (FFmpeg) and browser engines to handle data formats safely without explicit sanitization logic in the skill's own scripts.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 28, 2026, 06:03 PM