fframes-video
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads a project initialization script from the author's official GitHub repository (dmtrKovalenko/fframes) to automate the creation of new video projects.
- [REMOTE_CODE_EXECUTION]: The skill uses a piped execution pattern to run the initialization script directly in the shell. This is a vendor-provided utility for setting up the development environment and project scaffolding.
- [COMMAND_EXECUTION]: The instructions include commands to install necessary system dependencies (ffmpeg, x264, clang, etc.) using platform-specific package managers like brew, apt-get, and pacman. It also utilizes cargo for installing the fframes CLI and running project-specific tasks.
- [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill processes user-supplied briefs, asset descriptions, and audio files to generate video content (SKILL.md).
- Boundary markers: Instructions advise the agent to 'Pin down the brief' and 'Ask the user for what is missing', establishing a framework for validating user input before processing.
- Capability inventory: The skill has the ability to execute shell commands, compile Rust code, and perform file system operations to render video frames and audio (SKILL.md, references/api.md).
- Sanitization: No explicit code-level sanitization is described, but the process relies on standard Rust compilation and fframes' internal rendering logic.
Audit Metadata