embedded-captions
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on several shell scripts and Node.js utilities that execute commands for media processing (ffmpeg, ffprobe), layout measurement (node), and path generation (python3). It also includes an update instruction using 'npx'.
- [EXTERNAL_DOWNLOADS]: During initialization, the skill downloads model weights for background removal (u2net_human_seg) to a local cache (~168 MB). Additionally, it uses 'uvx' to download and run the 'whisperx' Python package for transcription.
- [DYNAMIC_EXECUTION]: The skill generates local HTML files containing GSAP animation logic and renders them using a headless Puppeteer browser to measure layout and generate frame previews.
- [INDIRECT_PROMPT_INJECTION]: The skill processes transcript data derived from user-supplied videos. This data is interpolated into HTML templates for rendering. The skill implements sanitization through an 'escBr' function to escape HTML special characters, mitigating common injection vectors.
Audit Metadata