weilanx-creator-desk-video

Pass

Audited by Gen Agent Trust Hub on Oct 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied themes and video files to generate video content, creating a surface where malicious input could influence generated scripts.\n
  • Ingestion points: User-provided themes (text) and live video recordings are stored in the materials/ directory for processing.\n
  • Boundary markers: There are no explicit delimiters or instructions to treat user-supplied strings as untrusted data when interpolating them into generated scripts like scenes.tsx.\n
  • Capability inventory: The skill utilizes extensive shell execution capabilities including npm, npx, ffmpeg, bash, and python3 across multiple scripts.\n
  • Sanitization: No sanitization or escaping mechanisms are described for user-supplied text before it is inserted into the Headline component or other generated template files.\n- [DYNAMIC_EXECUTION]: The skill's primary function involves generating and then executing source code and scripts at runtime.\n
  • The workflow generates React components (.tsx) and JavaScript scripts (.mjs) for each episode based on templates and user input.\n
  • These generated files are subsequently executed by node (for BGM synthesis) and npx remotion (for frame rendering and video export).\n- [COMMAND_EXECUTION]: The skill frequently executes shell commands for file management, audio processing, and project compilation.\n
  • Local scripts such as bash scripts/ep-dir.sh are used to initialize project structures.\n
  • The ffmpeg utility is employed for audio normalization, speed adjustments (1.2x), and video transcoding.\n
  • Standard project commands like npm run export, npm run cues, and npm test are invoked to build and validate the video assets.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 19, 2026, 06:16 PM