blitzreels-cli
Pass
Audited by Gen Agent Trust Hub on May 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill operates by executing shell commands via the BlitzReels CLI (
npx blitzreels). These commands allow for project management, media manipulation, and timeline editing as part of its core functionality. - [EXTERNAL_DOWNLOADS]: The skill utilizes
npxto fetch and execute theblitzreelsand@blitzreels/clipackages from the npm registry. This is the standard and intended method for utilizing the vendor's command-line tools. - [DATA_EXFILTRATION]: The instructions acknowledge the storage of API keys in
~/.blitzreels/config.jsonand environment variables. Critically, it provides explicit directives to prevent the leakage of these credentials in any agent outputs, notes, or handoff files. - [PROMPT_INJECTION]: The skill processes potentially untrusted data such as video captions and project metadata. It manages the risk of indirect prompt injection by emphasizing the use of structured JSON output for machine parsing and requiring manual or plan-based verification before performing destructive actions.
Audit Metadata