depth-ui
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a Node.js script (
run.cjs) from a sibling directory to perform video editing tasks. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text strings that are rendered into the final video output. 1. Ingestion points: The
--wordsargument used in the shell command described inSKILL.md. 2. Boundary markers: None present to distinguish instructions from data. 3. Capability inventory: Executes local Node.js scripts and writes to the filesystem. 4. Sanitization: No input sanitization or validation is mentioned. - [EXTERNAL_DOWNLOADS]: The instructions require the user to install third-party dependencies including FFmpeg, Node.js, Puppeteer, and Torch.
Audit Metadata