business-motion-film
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses utility scripts (e.g.,
offline-mix.py,loudness.sh,sfx-candidates.py) to process audio and video viaffmpeg. These scripts are properly parameterized to avoid shell injection vulnerabilities. - [INDIRECT_PROMPT_INJECTION]: The 'Gauntlet' loop described in
references/gauntlet.mdinvolves feeding project data and client feedback into critic prompts for subsequent agent sessions. - Ingestion points: Project briefs and user feedback in
SKILL.md. - Boundary markers: Uses placeholder tags for interpolation but lacks strict sanitization or instructions to ignore embedded commands.
- Capability inventory: Ability to run media scripts, modify files, and access external assets.
- Sanitization: Untrusted input is interpolated without specific escaping or validation.
- [EXTERNAL_DOWNLOADS]: The skill fetches resources from well-known services: the GSAP library from JSDelivr (
templates/component-lab.html) and stock audio from Mixkit (references/audio.md). - [DYNAMIC_EXECUTION]: The workflow involves generating and executing Three.js and GSAP code for rendering video frames, utilizing tools like
npx hyperframesas documented intemplates/component-lab.html.
Audit Metadata