Skills
Navigate
skills/charlie947/reel-editing-skills/pull-back-reveal/Gen Agent Trust Hub

pull-back-reveal

Pass

Audited by Gen Agent Trust Hub on Oct 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute a local JavaScript file using Node.js: node ~/.claude/skills/video-effects/run.cjs. This relies on the presence of a companion utility in the user's home directory.
  • [EXTERNAL_DOWNLOADS]: The documentation requires the user to install the video-effects engine and several heavy dependencies, including ffmpeg, Puppeteer, and torch, which are used for video rendering and machine learning.
  • [INDIRECT_PROMPT_INJECTION]: The execution command template interpolates a user-provided string directly into the --words argument. This represents an attack surface for indirect prompt injection or command injection.
  • Ingestion points: User-supplied text provided to the --words parameter in SKILL.md.
  • Boundary markers: None; the text is placed directly inside quotes within a shell command.
  • Capability inventory: Subprocess execution via node.
  • Sanitization: No sanitization or escaping logic is visible in the instructions; the skill assumes the agent or the underlying run.cjs script handles malicious input correctly.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 23, 2026, 09:43 AM