gitframes-render
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation and import of the
gitframespackage from the npm registry, which is the core dependency for its rendering capabilities.\n- [COMMAND_EXECUTION]: Instructions involve executing shell commands for development workflows, specificallynpx tscfor typechecking,tsxfor running render scripts, andffmpegorffprobefor inspecting output media files.\n- [DYNAMIC_EXECUTION]: ThestartPreviewfunction facilitates dynamic execution by hosting a local server to run composition code within a browser environment for real-time visual feedback.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes external composition specifications, which represents an indirect prompt injection surface.\n - Ingestion points: Reads composition logic and specifications from modules like
film.tsreferenced inSKILL.md.\n - Boundary markers: The skill explicitly recommends a 'Verification Ladder' and uses
CompositorProgramSchemato define expected data structures.\n - Capability inventory: Includes file system operations (
fs.writeFile,fs.mkdir) in the render script and local network hosting viastartPreview.\n - Sanitization: Implements runtime validation using
CompositorProgramSchema.safeParseand static analysis via TypeScript (npx tsc) to ensure spec conformance.
Audit Metadata