weilanx-creator-desk-video
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied themes and video files to generate video content, creating a surface where malicious input could influence generated scripts.\n
- Ingestion points: User-provided themes (text) and live video recordings are stored in the
materials/directory for processing.\n - Boundary markers: There are no explicit delimiters or instructions to treat user-supplied strings as untrusted data when interpolating them into generated scripts like
scenes.tsx.\n - Capability inventory: The skill utilizes extensive shell execution capabilities including
npm,npx,ffmpeg,bash, andpython3across multiple scripts.\n - Sanitization: No sanitization or escaping mechanisms are described for user-supplied text before it is inserted into the
Headlinecomponent or other generated template files.\n- [DYNAMIC_EXECUTION]: The skill's primary function involves generating and then executing source code and scripts at runtime.\n - The workflow generates React components (
.tsx) and JavaScript scripts (.mjs) for each episode based on templates and user input.\n - These generated files are subsequently executed by
node(for BGM synthesis) andnpx remotion(for frame rendering and video export).\n- [COMMAND_EXECUTION]: The skill frequently executes shell commands for file management, audio processing, and project compilation.\n - Local scripts such as
bash scripts/ep-dir.share used to initialize project structures.\n - The
ffmpegutility is employed for audio normalization, speed adjustments (1.2x), and video transcoding.\n - Standard project commands like
npm run export,npm run cues, andnpm testare invoked to build and validate the video assets.
Audit Metadata