skills/editframe/skills/composition/Gen Agent Trust Hub

composition

Pass

Audited by Gen Agent Trust Hub on Oct 12, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill supports parameterizing video compositions with external JSON data through getRenderData<T>() and the useRenderData<T>() React hook. This data is typically injected by a render host (like a Playwright script) into window.EF_RENDER_DATA.
  • Ingestion points: window.EF_RENDER_DATA via getRenderData() or useRenderData() in SKILL.md.
  • Boundary markers: No explicit boundary markers or instructions to ignore embedded commands in the injected data are documented.
  • Capability inventory: The skill can render text to video via ef-text, execute custom JavaScript via addFrameTask, and perform network operations via a feedback mechanism.
  • Sanitization: The documentation does not specify any sanitization or validation requirements for the injected JSON data before it is used in the composition.
  • [DYNAMIC_EXECUTION]: The skill provides the initializer property and addFrameTask method to register and execute custom JavaScript callbacks synchronized with the video composition's clock. This allows for procedural geometry, counters, or other computed states to be generated at runtime.
  • [COMMAND_EXECUTION]: Includes a documented curl command example for sending feedback to the vendor's API at https://editframe.com/api/v1/feedback. This is a manual utility provided for user feedback and involves transmitting technical details and workarounds to the vendor.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 12, 2026, 05:56 PM