screen-in-screen
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill directs the agent to execute a Node.js command using a script located at
~/.claude/skills/video-effects/run.cjs. This script is used to process video files provided as arguments. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-supplied MP4 files, which represents an attack surface for indirect injection via file metadata or content processing. Ingestion points: The
my-clip.mp4input file specified in the command line instructions. Boundary markers: Absent. Capability inventory: The skill facilitates file reading and writing through the execution of an external script. Sanitization: None specified in the instructions. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of external components including
ffmpeg,Node,Puppeteer, andtorch. These are well-known, standard libraries for video processing and automation.
Audit Metadata