phone-fan

Pass

Audited by Gen Agent Trust Hub on Oct 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a local Node.js script (run.cjs) to process video files. The command structure uses positional arguments for the effect name, input video path, and output video path.
  • [EXTERNAL_DOWNLOADS]: The skill documentation specifies a dependency on an external engine called video-effects that must be installed locally. This engine is required to provide the rendering capabilities (ffmpeg, Puppeteer) needed for the effect.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data in the form of MP4 video files and their filenames. While these are used as inputs for a media processing script, the documentation does not specify explicit boundary markers or sanitization logic for these inputs.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 23, 2026, 09:43 AM