scroll-sequence
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes user-provided video files using
ffprobeand ingests the resulting metadata (duration, resolution, frame rate) into the agent's context to calculate processing parameters. This establishes a surface for indirect prompt injection if the video file contains malicious metadata designed to influence the agent's instructions. - Ingestion points: Video metadata extracted via
ffprobeinSKILL.md. - Boundary markers: None used for metadata ingestion.
- Capability inventory: Shell command execution (
ffmpeg,ffprobe,bash), file system modification, and local server execution. - Sanitization: Video file paths are quoted in shell commands.
- [COMMAND_EXECUTION]: The skill performs several automated shell operations to manage files and process media.
- Checks for and executes
ffmpegandffprobefor video frame extraction and analysis. - Orchestrates deployment by executing shell scripts from relative skill directories (e.g.,
skills/vercel-deploy/scripts/deploy.sh). - Facilitates local testing using
npx serveor Python's built-in HTTP server. - [EXTERNAL_DOWNLOADS]: The generated website template incorporates third-party JavaScript libraries via public CDN links.
- Fetches the Lenis smooth scroll library from
cdn.jsdelivr.net. - Fetches the GSAP animation library and the ScrollTrigger plugin from
cdn.jsdelivr.net.
Audit Metadata