shared-product-motion-video

Pass

Audited by Gen Agent Trust Hub on Sep 29, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The fetch-fonts.sh script downloads open-source fonts from trusted GitHub organizations including rsms, Google, and JetBrains. These downloads are necessary for the skill's typography requirements and are performed from well-known repositories.
  • [COMMAND_EXECUTION]: The skill executes ffmpeg through subprocess calls in Render.kt to process video and audio. This is a core requirement for generating the output media files.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text for rendering into motion videos. Ingestion points: Strings defined in ExampleFilm.kt and storyboard templates are used as titles, taglines, and captions. Boundary markers: No explicit boundaries are used as the data is treated as literal text for visual rendering. Capability inventory: The skill can perform file writes and execute ffmpeg commands. Sanitization: Inputs are visually rendered using the Compose Desktop engine and are not executed as code or interpreted as agent instructions, mitigating injection risks.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 29, 2026, 08:57 AM