make-video
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses npx to download and execute the @helios-project/cli package from the NPM registry at runtime for video rendering purposes.\n- [COMMAND_EXECUTION]: Invokes shell commands including npx for rendering and verification, and ffmpeg for converting MP4 files to GIF format.\n- [DYNAMIC_EXECUTION]: The agent is instructed to write custom HTML and JavaScript code that is subsequently executed in a headless browser to generate video frames.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user descriptions and external data files to generate executable code, creating a surface for potential instruction injection.\n
- Ingestion points: User prompts and external data files (e.g., track.beats.json, .srt) processed in SKILL.md and references/music.md.\n
- Boundary markers: No specific delimiters or instructions to ignore embedded commands are included in the code generation process.\n
- Capability inventory: Execution of shell commands (npx, ffmpeg) and headless browser JavaScript execution.\n
- Sanitization: No explicit sanitization or escaping of external content is required before interpolation into the generated code.
Audit Metadata