weilanx-creator-fps-video
Warn
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: MEDIUMPROMPT_INJECTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill contains explicit instructions to override the agent's standard behavior by skipping all user confirmation and preview steps during the video production process. Phrases like '授权你从头做到交付' (authorize you to do it from head to delivery) and '全程不停下来问用户确认' (don't stop to ask for confirmation) are designed to bypass human-in-the-loop safety checkpoints.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources such as game blogs, patch notes, and research papers via the
web-readertool or Python scripts. - Ingestion points: External URLs processed by
webReaderorurllibto fetch '一手资料' (primary sources). - Boundary markers: None identified; data is directly interpolated into generated code constants.
- Capability inventory: The skill uses
execFileSync,spawnSync, andnodeto execute generated files. - Sanitization: No sanitization or escaping of external content is specified before it is written into executable
.tsor.mjsfiles. - [DYNAMIC_EXECUTION]: The workflow requires the agent to generate new TypeScript and JavaScript files (e.g.,
timeline.ts,scenes.tsx,audio/episodes/*.mjs) for each video episode. These files are then dynamically executed by the system usingnodeandnpx remotion. Specifically, theqa.mjsscript dynamically imports the agent-generatedtimeline.tsfile, and the audio generation script is executed directly vianode. - [COMMAND_EXECUTION]: The skill makes extensive use of shell commands and bash scripts to manage file systems, process media with
ffmpeg, and perform quality assurance checks. Examples includebash scripts/ep-dir.shfor directory creation andffmpegfor frame extraction and loudness measurement. - [EXTERNAL_DOWNLOADS]: The skill fetches research data and metadata from well-known services including PubMed, OpenAlex, and game developer blogs (e.g., Riot Games, Valve). It also references 'private skills' for image generation and title optimization, which are treated as vendor-specific internal resources.
Audit Metadata