title-orbit
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documents a command to execute a local Node.js script (
run.cjs) from a sibling directory (~/.claude/skills/video-effects/) for video processing. - [EXTERNAL_DOWNLOADS]: The skill requires an external 'video-effects' engine and several system-level dependencies such as ffmpeg, Puppeteer, and torch which are not included in the package.
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection through its input mechanism.
- Ingestion points: The
--wordsparameter in the documented run command (SKILL.md). - Boundary markers: None; there are no delimiters or instructions to prevent the agent from following commands embedded in the provided text.
- Capability inventory: The skill triggers a Node.js process that likely executes shell commands (e.g., via ffmpeg) to generate the video effect.
- Sanitization: None; the skill does not mention any validation or escaping of the user-provided text input.
Audit Metadata