video-asset-reels
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill automates video processing by invoking
ffmpegandffprobethroughexecFileSyncwithin thecut-assets.mjsandrender-frames.mjsscripts to handle media clipping and final MP4 assembly. - [EXTERNAL_DOWNLOADS]: The skill instructions specify the installation of
playwrightvianpmfor frame rendering, and the HTML composition fetches the GSAP animation library from a well-known CDN (cdn.jsdelivr.net). - [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by processing user-supplied prompts to generate a
storyboard.jsonmanifest that drives the execution of subsequent scripts. - Ingestion points: User prompts are ingested during Stage 1 to define the beat sheet and asset metadata in
storyboard.json. - Boundary markers: The skill does not define specific delimiters or warnings to prevent the agent from obeying instructions embedded within user-provided prompts.
- Capability inventory: The skill possesses capabilities for file system writing, media processing via
ffmpeg, and automated browser interactions via Playwright. - Sanitization: The scripts use standard path resolution and type conversion for manifest values, though they rely on the agent to correctly structure the data inputs.
Audit Metadata