fframes-video

Pass

Audited by Gen Agent Trust Hub on Oct 19, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads a project initialization script from the author's official GitHub repository (dmtrKovalenko/fframes) to automate the creation of new video projects.
  • [REMOTE_CODE_EXECUTION]: The skill uses a piped execution pattern to run the initialization script directly in the shell. This is a vendor-provided utility for setting up the development environment and project scaffolding.
  • [COMMAND_EXECUTION]: The instructions include commands to install necessary system dependencies (ffmpeg, x264, clang, etc.) using platform-specific package managers like brew, apt-get, and pacman. It also utilizes cargo for installing the fframes CLI and running project-specific tasks.
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: The skill processes user-supplied briefs, asset descriptions, and audio files to generate video content (SKILL.md).
  • Boundary markers: Instructions advise the agent to 'Pin down the brief' and 'Ask the user for what is missing', establishing a framework for validating user input before processing.
  • Capability inventory: The skill has the ability to execute shell commands, compile Rust code, and perform file system operations to render video frames and audio (SKILL.md, references/api.md).
  • Sanitization: No explicit code-level sanitization is described, but the process relies on standard Rust compilation and fframes' internal rendering logic.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 19, 2026, 06:30 PM