scroll-sequence

Pass

Audited by Gen Agent Trust Hub on Sep 28, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill analyzes user-provided video files using ffprobe and ingests the resulting metadata (duration, resolution, frame rate) into the agent's context to calculate processing parameters. This establishes a surface for indirect prompt injection if the video file contains malicious metadata designed to influence the agent's instructions.
  • Ingestion points: Video metadata extracted via ffprobe in SKILL.md.
  • Boundary markers: None used for metadata ingestion.
  • Capability inventory: Shell command execution (ffmpeg, ffprobe, bash), file system modification, and local server execution.
  • Sanitization: Video file paths are quoted in shell commands.
  • [COMMAND_EXECUTION]: The skill performs several automated shell operations to manage files and process media.
  • Checks for and executes ffmpeg and ffprobe for video frame extraction and analysis.
  • Orchestrates deployment by executing shell scripts from relative skill directories (e.g., skills/vercel-deploy/scripts/deploy.sh).
  • Facilitates local testing using npx serve or Python's built-in HTTP server.
  • [EXTERNAL_DOWNLOADS]: The generated website template incorporates third-party JavaScript libraries via public CDN links.
  • Fetches the Lenis smooth scroll library from cdn.jsdelivr.net.
  • Fetches the GSAP animation library and the ScrollTrigger plugin from cdn.jsdelivr.net.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 28, 2026, 01:57 PM