carousel-creator

Pass

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill automates the creation and processing of SVG files by executing local shell scripts (.zsh) and a dedicated Python validation script (verify-carousel-slides.py). These scripts rely on standard system-level CLI tools such as ffmpeg, magick (ImageMagick), and rsvg-convert (librsvg) to handle rasterization and video encoding.
  • [EXTERNAL_DOWNLOADS]: To perform cinematic video rendering, the skill uses npx to execute the hyperframes package directly from the NPM registry. It also generates HTML templates that reference the GSAP animation library from the jsdelivr CDN. Both NPM and jsDelivr are recognized as well-known, trusted services.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied topics and audience descriptions to generate slide content. While there are no explicit prompt boundary markers in the instructions, the skill mitigates risks by requiring a structural validation pass using Python's xml.etree.ElementTree to verify that the generated SVGs are well-formed and safe for processing.
  • [DYNAMIC_EXECUTION]: The skill creates a cinematic video output by dynamically generating an HTML file at runtime. This file incorporates the generated SVG slides and uses JavaScript (GSAP) to apply animations before being rendered into an MP4 file via the Hyperframes utility.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 1, 2026, 11:52 AM