skills/getedgehq/skills/launch-film/Gen Agent Trust Hub

launch-film

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes external media processing binaries to render the final video output.
  • scripts/render.py uses subprocess.Popen to call ffmpeg for encoding video and audio streams from browser-rendered frames.
  • The script also calls ffprobe to verify the metadata of the generated MP4 file.
  • Security measures: Input parameters such as width, height, and FPS are cast to integers and validated before being passed to the command line.
  • [DYNAMIC_EXECUTION]: The rendering pipeline involves dynamic execution of JavaScript within a browser context.
  • scripts/render.py utilizes the Playwright library to launch a headless Chromium instance to render the film.html template.
  • The script inlines local project scripts into the HTML and executes window.renderAt(t) to capture individual frames.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied project configuration files, creating a potential attack surface for indirect instructions.
  • Ingestion points: The agent is instructed to read brief.js and brief.json from the project directory to define the film's content and timing.
  • Boundary markers: The skill documentation includes extensive instructions on verifying evidence and clearing assets, though no explicit string delimiters are mandated for data interpolation.
  • Capability inventory: The skill has the capability to write files, execute subprocesses (ffmpeg), and perform network operations via Playwright (though primarily used for local rendering).
  • Sanitization: The Python scripts validate numeric inputs (dimensions, duration) before use in shell commands, reducing the risk of command injection via configuration data.
  • [EXTERNAL_DOWNLOADS]: The skill requires standard Python libraries for data processing and video manipulation.
  • requirements.txt specifies numpy, Pillow, PyYAML, playwright, and av (PyAV). These are well-known packages from the official PyPI registry.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 12:08 AM