canvas-film
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The utility script
scripts/film.pyperforms extensive media processing by invokingffmpegandffprobe. These calls are implemented using list-based arguments without a shell, mitigating command injection risks while enabling audio normalization, mixing, and video assembly. - [EXTERNAL_DOWNLOADS]: The skill interacts with established third-party services to generate assets. It downloads Google Fonts via
fonts.googleapis.comand communicates with the ElevenLabs API (api.elevenlabs.io) for voice synthesis and transcription. These external references are restricted to well-known service providers and are essential for the skill's functionality. - [DYNAMIC_EXECUTION]: The skill builds a standalone HTML environment to render animations. It inlines JavaScript logic and base64-encoded assets into an HTML template, which is then executed in a headless browser via Playwright to generate frame-perfect video content. This architecture is standard for high-fidelity canvas-based video generation.
Audit Metadata