launch-film
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes external media processing binaries to render the final video output.
scripts/render.pyusessubprocess.Popento callffmpegfor encoding video and audio streams from browser-rendered frames.- The script also calls
ffprobeto verify the metadata of the generated MP4 file. - Security measures: Input parameters such as width, height, and FPS are cast to integers and validated before being passed to the command line.
- [DYNAMIC_EXECUTION]: The rendering pipeline involves dynamic execution of JavaScript within a browser context.
scripts/render.pyutilizes the Playwright library to launch a headless Chromium instance to render thefilm.htmltemplate.- The script inlines local project scripts into the HTML and executes
window.renderAt(t)to capture individual frames. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied project configuration files, creating a potential attack surface for indirect instructions.
- Ingestion points: The agent is instructed to read
brief.jsandbrief.jsonfrom the project directory to define the film's content and timing. - Boundary markers: The skill documentation includes extensive instructions on verifying evidence and clearing assets, though no explicit string delimiters are mandated for data interpolation.
- Capability inventory: The skill has the capability to write files, execute subprocesses (
ffmpeg), and perform network operations via Playwright (though primarily used for local rendering). - Sanitization: The Python scripts validate numeric inputs (dimensions, duration) before use in shell commands, reducing the risk of command injection via configuration data.
- [EXTERNAL_DOWNLOADS]: The skill requires standard Python libraries for data processing and video manipulation.
requirements.txtspecifiesnumpy,Pillow,PyYAML,playwright, andav(PyAV). These are well-known packages from the official PyPI registry.
Audit Metadata