title-orbit

Pass

Audited by Gen Agent Trust Hub on Oct 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill documents a command to execute a local Node.js script (run.cjs) from a sibling directory (~/.claude/skills/video-effects/) for video processing.
  • [EXTERNAL_DOWNLOADS]: The skill requires an external 'video-effects' engine and several system-level dependencies such as ffmpeg, Puppeteer, and torch which are not included in the package.
  • [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection through its input mechanism.
  • Ingestion points: The --words parameter in the documented run command (SKILL.md).
  • Boundary markers: None; there are no delimiters or instructions to prevent the agent from following commands embedded in the provided text.
  • Capability inventory: The skill triggers a Node.js process that likely executes shell commands (e.g., via ffmpeg) to generate the video effect.
  • Sanitization: None; the skill does not mention any validation or escaping of the user-provided text input.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 23, 2026, 09:44 AM