video-js
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local shell script
bash scripts/validate-recording.shto verify that the video recording hooks are correctly implemented before completing the build process.- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input and assets by passing them to a subagent with expanded tool access (e.g., web search, asset generation). While this presents an attack surface, the instructions include boundary markers to compartmentalize user content from system directives.- [EXTERNAL_DOWNLOADS]: The skill utilizes Google Fonts and may install Node.js animation libraries (e.g., Framer Motion, GSAP, Three.js) via official package registries to support video generation.
Audit Metadata