remix-apple-notes-ad-from-sample
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on several local CLI tools to perform its core rendering tasks.
- Evidence: It invokes
ffmpegfor video encoding and poster frame extraction,ffprobefor duration verification, andnodeto execute Playwright-based recording scripts (record-master.js) and end-card generation scripts. - Evidence: It uses shell scripts (
stitch.sh) to assemble the final video components. - [EXTERNAL_DOWNLOADS]: The skill involves downloading necessary software binaries and project-specific assets.
- Evidence: Phase 0 includes a preflight check that may instruct the user to run
brew install ffmpegornpx playwright install chromiumif they are missing from the environment. - Evidence: The workflow fetches brand assets (wordmarks, product images) and audio files from the Gooseworks platform via MCP tools and PUT requests to provided upload URLs.
- [SAFE]: The identified command execution and network operations are essential for a video production tool and align perfectly with the skill's documented purpose.
- Evidence: The use of
ffmpegand Playwright is standard for automated video generation. All network communication is conducted through vendor-provided MCP tools (get_ad_project,get_upload_url, etc.) or official platform proxies (ElevenLabs proxy), which is expected behavior for an ad-tech integration skill.
Audit Metadata