shared-product-motion-video
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
fetch-fonts.shscript downloads open-source fonts from trusted GitHub organizations including rsms, Google, and JetBrains. These downloads are necessary for the skill's typography requirements and are performed from well-known repositories. - [COMMAND_EXECUTION]: The skill executes
ffmpegthrough subprocess calls inRender.ktto process video and audio. This is a core requirement for generating the output media files. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text for rendering into motion videos. Ingestion points: Strings defined in
ExampleFilm.ktand storyboard templates are used as titles, taglines, and captions. Boundary markers: No explicit boundaries are used as the data is treated as literal text for visual rendering. Capability inventory: The skill can perform file writes and executeffmpegcommands. Sanitization: Inputs are visually rendered using the Compose Desktop engine and are not executed as code or interpreted as agent instructions, mitigating injection risks.
Audit Metadata