video-interaction-mapper
Pass
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill performs local command execution to process video data.
- The scripts
extract_key_frames.pyandresolve_moment_frames.pyusesubprocess.runto callffmpegandffprobefor frame extraction and metadata retrieval. - The workflow generates and executes JavaScript code (
figma_storyboard.jsandfigma_apply_fills.js) using theuse_figmatool to automate design updates in Figma based on analyzed video content. - [EXTERNAL_DOWNLOADS]: The
SKILL.mdfile contains instructions to install thePillowlibrary viapipif it is not found in the environment.Pillowis a trusted and standard Python library for image manipulation. - [PROMPT_INJECTION]: The skill has an indirect prompt injection surface because it ingests untrusted video data to generate storyboard annotations.
- Ingestion points: Local video file specified by the user and processed by
extract_key_frames.py. - Boundary markers: None identified for binary video input.
- Capability inventory: Subprocess execution for video tools; Figma API interaction via
use_figmainSKILL.md. - Sanitization: The skill uses
json.dumpsingenerate_figma_calls.pywhen embedding extracted metadata into generated JavaScript to prevent structural injection.
Audit Metadata