composition
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill supports parameterizing video compositions with external JSON data through
getRenderData<T>()and theuseRenderData<T>()React hook. This data is typically injected by a render host (like a Playwright script) intowindow.EF_RENDER_DATA. - Ingestion points:
window.EF_RENDER_DATAviagetRenderData()oruseRenderData()inSKILL.md. - Boundary markers: No explicit boundary markers or instructions to ignore embedded commands in the injected data are documented.
- Capability inventory: The skill can render text to video via
ef-text, execute custom JavaScript viaaddFrameTask, and perform network operations via a feedback mechanism. - Sanitization: The documentation does not specify any sanitization or validation requirements for the injected JSON data before it is used in the composition.
- [DYNAMIC_EXECUTION]: The skill provides the
initializerproperty andaddFrameTaskmethod to register and execute custom JavaScript callbacks synchronized with the video composition's clock. This allows for procedural geometry, counters, or other computed states to be generated at runtime. - [COMMAND_EXECUTION]: Includes a documented
curlcommand example for sending feedback to the vendor's API athttps://editframe.com/api/v1/feedback. This is a manual utility provided for user feedback and involves transmitting technical details and workarounds to the vendor.
Audit Metadata