framefields-render
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill follows established software development and media rendering best practices. No malicious code, obfuscation, or injection attempts were detected.
- [DATA_EXPOSURE_AND_EXFILTRATION]: File operations are limited to project-local directories for outputting frames and videos (e.g.,
output/). There is no evidence of sensitive data harvesting or exfiltration to external domains. - [COMMAND_EXECUTION]: The skill uses standard CLI tools such as
tsc,ffmpeg, andffprobefor legitimate build and inspection tasks. These operations are restricted to the local environment and are expected within a rendering workflow. - [INDIRECT_PROMPT_INJECTION]: The skill defines an interface for ingesting user feedback via
notes.jsonduring the preview phase. While this represents a data ingestion surface, it is a documented feature for collaborative review and does not exhibit malicious patterns. - [DYNAMIC_EXECUTION]: The
startPreviewfunction dynamically loads a composition module from a local file path. This is a standard architectural pattern for modular media engines and is implemented using project-relative paths.
Audit Metadata