mira-after-effects

Pass

Audited by Gen Agent Trust Hub on Nov 4, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill makes extensive use of the adobe_execute_script tool to run dynamically generated ExtendScript (ES3) directly within the Adobe After Effects environment. This is a core functionality that allows the agent to programmatically manipulate compositions, layers, and effects. It also utilizes $.evalFile to load and execute local script libraries from computed or absolute paths.
  • [EXTERNAL_DOWNLOADS]: Several tools, including adobe_place_element, adobe_install_fonts, and adobe_import_generation, are designed to download and install external assets such as overlays, templates, fonts, and AI-generated footage from the vendor's 'Mira Elements' library and related services.
  • [DATA_EXFILTRATION]: The adobe_render tool includes a feature to optionally upload rendered video files to the vendor's 'Mira library'. While this involves sending user data to an external service, it is a declared and integral feature of the Mira workflow.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests and processes untrusted data from existing user projects and external video references.
  • Ingestion points: Project data is read via adobe_get_project (including layer names, source text, and markers) and external videos are analyzed via adobe_reference.
  • Boundary markers: No specific delimiters or instructions to ignore embedded commands within user-provided data are mentioned in the documentation.
  • Capability inventory: The agent has significant capabilities, including arbitrary script execution (adobe_execute_script), file system writes/renders (adobe_render), and network-based asset installation (adobe_place_element).
  • Sanitization: There is no evidence of sanitization or filtering for the metadata ingested from project layers or markers before it is used in subsequent reasoning or script generation steps.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 4, 2026, 04:24 PM