create-imessage-video-ad
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of
ffmpegto process video and audio. These commands are executed viaexecSyncin Node.js templates (record-master.template.js,render-end-card.template.js) andsubprocess.runin Python helper scripts within Bash templates (stitch.template.sh). All executions are directed at local file processing and are consistent with the skill's primary purpose. - [EXTERNAL_DOWNLOADS]: The
fal_helpers.pyscript includes functionality to download generated assets from the FAL.ai service using standard Python libraries. This is used for generating photographic backgrounds or end-card assets as specified in the workflow. - [DYNAMIC_EXECUTION]: The skill uses dynamic execution patterns for automation. For example,
record-master.template.jsinjects a driver script into a Playwright browser context to control message timing. Additionally,stitch.template.shexecutes an inline Python script via a heredoc to calculate audio offsets and build complex ffmpeg filter chains. - [CREDENTIALS_UNSAFE]: The skill properly handles API keys for the FAL.ai service. The
load_fal_key()function infal_helpers.pyretrieves secrets from environment variables or.envfiles rather than using hardcoded values, which aligns with security best practices.
Audit Metadata