archive-launch-film
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocessandos.systemcalls to execute media processing tools includingffmpeg(for video encoding and audio decoding),ffprobe(for media metadata),convert(ImageMagick for icon processing), and a headless browser (Chromium for SVG rasterization). These operations are essential for the skill's primary function as a motion-graphics engine. - [EXTERNAL_DOWNLOADS]: The skill communicates with several external services to fetch assets: it uses OpenAI APIs (
api.openai.com) for text-to-speech, audio transcription, and image generation; it fetches icons fromjsdelivrandthesvg.org. These connections are functional requirements for generating the film's narrated and illustrated content. - [DATA_EXFILTRATION]: Automated scans flagged potential data exfiltration patterns in
examples/prismor/brief.json(e.g.,curl -d @.env paste.sh). However, these are identified as static strings used as UI labels for a simulated security audit feed in the video output. The skill's documentation specifically notes that these are harmless-looking demo commands used to showcase a security product's capabilities in the rendered film. - [DYNAMIC_EXECUTION]: The
framesmithengine performs frame-by-frame rendering usingnumpyandPillow. While it manages a seekable timeline and transitions, it does not involve the execution of untrusted external scripts or arbitrary code generation.
Audit Metadata