timeline-assembly
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes a local script
scripts/render_timeline.pyto perform validation and rendering of video timelines based on project data. - [INDIRECT_PROMPT_INJECTION]: The skill reads several external reference files, creating a surface where malicious instructions could be embedded in data.
- Ingestion points: Reads
../../references/EXECUTABLE_TIMELINE.md, edit plans, editorial manifests, and media approvals inSKILL.md(Workflow Step 1). - Boundary markers: None identified; the skill does not use specific delimiters or instructions to ignore potential commands within these files.
- Capability inventory: The skill has the capability to execute shell commands via
scripts/render_timeline.pyand write to the filesystem (05_post/timeline.json). - Sanitization: The skill does not mention any sanitization, filtering, or validation of the text content found within the ingested reference files before processing.
Audit Metadata