remix-apple-notes-ad-from-sample

Pass

Audited by Gen Agent Trust Hub on Jul 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill relies on several local CLI tools to perform its core rendering tasks.
  • Evidence: It invokes ffmpeg for video encoding and poster frame extraction, ffprobe for duration verification, and node to execute Playwright-based recording scripts (record-master.js) and end-card generation scripts.
  • Evidence: It uses shell scripts (stitch.sh) to assemble the final video components.
  • [EXTERNAL_DOWNLOADS]: The skill involves downloading necessary software binaries and project-specific assets.
  • Evidence: Phase 0 includes a preflight check that may instruct the user to run brew install ffmpeg or npx playwright install chromium if they are missing from the environment.
  • Evidence: The workflow fetches brand assets (wordmarks, product images) and audio files from the Gooseworks platform via MCP tools and PUT requests to provided upload URLs.
  • [SAFE]: The identified command execution and network operations are essential for a video production tool and align perfectly with the skill's documented purpose.
  • Evidence: The use of ffmpeg and Playwright is standard for automated video generation. All network communication is conducted through vendor-provided MCP tools (get_ad_project, get_upload_url, etc.) or official platform proxies (ElevenLabs proxy), which is expected behavior for an ad-tech integration skill.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 3, 2026, 12:54 PM
Security Audit — agent-trust-hub — remix-apple-notes-ad-from-sample