video-interaction-mapper

Pass

Audited by Gen Agent Trust Hub on Jul 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill performs local command execution to process video data.
  • The scripts extract_key_frames.py and resolve_moment_frames.py use subprocess.run to call ffmpeg and ffprobe for frame extraction and metadata retrieval.
  • The workflow generates and executes JavaScript code (figma_storyboard.js and figma_apply_fills.js) using the use_figma tool to automate design updates in Figma based on analyzed video content.
  • [EXTERNAL_DOWNLOADS]: The SKILL.md file contains instructions to install the Pillow library via pip if it is not found in the environment. Pillow is a trusted and standard Python library for image manipulation.
  • [PROMPT_INJECTION]: The skill has an indirect prompt injection surface because it ingests untrusted video data to generate storyboard annotations.
  • Ingestion points: Local video file specified by the user and processed by extract_key_frames.py.
  • Boundary markers: None identified for binary video input.
  • Capability inventory: Subprocess execution for video tools; Figma API interaction via use_figma in SKILL.md.
  • Sanitization: The skill uses json.dumps in generate_figma_calls.py when embedding extracted metadata into generated JavaScript to prevent structural injection.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 7, 2026, 05:08 PM
Security Audit — agent-trust-hub — video-interaction-mapper