demo-video
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches 'faster-whisper' from its repository (github.com/SYSTRAN/faster-whisper) and official 'remotion' packages using standard package managers to enable transcription and video rendering capabilities.
- [COMMAND_EXECUTION]: Uses 'ffmpeg', 'ffprobe', and 'pnpm' commands to process media, measure audio durations, and manage the video rendering pipeline.
- [DYNAMIC_EXECUTION]: Generates and executes local Python scripts for word-level audio alignment and Node.js scripts for batch rendering video stills. It also uses browser automation tools to evaluate JavaScript within a captured web context for element identification.
- [INDIRECT_PROMPT_INJECTION]: The skill processes content from external web pages via browser captures (SKILL.md, references/motion.md). Ingestion points: browser captures and interaction recordings. Boundary markers: synthetic fixture labeling and synthetic narration are used to differentiate generated content. Capability inventory: subprocess calls (ffmpeg, python3, pnpm) and local file writing. Sanitization: instructions are provided to check for sensitive content in captures before use.
Audit Metadata