archive-launch-film

Pass

Audited by Gen Agent Trust Hub on Oct 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess and os.system calls to execute media processing tools including ffmpeg (for video encoding and audio decoding), ffprobe (for media metadata), convert (ImageMagick for icon processing), and a headless browser (Chromium for SVG rasterization). These operations are essential for the skill's primary function as a motion-graphics engine.
  • [EXTERNAL_DOWNLOADS]: The skill communicates with several external services to fetch assets: it uses OpenAI APIs (api.openai.com) for text-to-speech, audio transcription, and image generation; it fetches icons from jsdelivr and thesvg.org. These connections are functional requirements for generating the film's narrated and illustrated content.
  • [DATA_EXFILTRATION]: Automated scans flagged potential data exfiltration patterns in examples/prismor/brief.json (e.g., curl -d @.env paste.sh). However, these are identified as static strings used as UI labels for a simulated security audit feed in the video output. The skill's documentation specifically notes that these are harmless-looking demo commands used to showcase a security product's capabilities in the rendered film.
  • [DYNAMIC_EXECUTION]: The framesmith engine performs frame-by-frame rendering using numpy and Pillow. While it manages a seekable timeline and transitions, it does not involve the execution of untrusted external scripts or arbitrary code generation.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 26, 2026, 10:19 AM