agent-native-mcp-architecture

Pass

Audited by Gen Agent Trust Hub on May 12, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill orchestrates several system utilities to perform its tasks. The bootstrap process in plugins/cadence/server/src/bootstrap.ts uses python3 and pip to set up a virtual environment. The core media logic in plugins/cadence/server/src/render/ffmpeg.ts and plugins/ecliptic/scripts/build-filter.sh executes ffmpeg and ffprobe for metadata extraction and video rendering. Communication with the Gemini API is handled via curl in plugins/ecliptic/scripts/gemini-edit-plan.sh.- [EXTERNAL_DOWNLOADS]: During its initial setup, the skill's bootstrap script downloads the librosa signal processing library from the official Python Package Index (PyPI) to handle audio beat detection.- [DYNAMIC_EXECUTION]: The skill dynamically generates FFmpeg filter_complex strings based on JSON data received from the Gemini AI model. These filters are used to precisely time cuts and transitions in the final video output.- [PROMPT_INJECTION]: The skill takes user-provided text as input for the 'creative intent' of the video. This input is interpolated into system prompts for the Gemini model in plugins/cadence/server/src/session.ts, which is a standard surface for indirect prompt injection, though handled through JSON escaping.
Audit Metadata
Risk Level
SAFE
Analyzed
May 12, 2026, 07:06 PM