render-3d-product-showcase
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The scripts
build_endcard.pyandbuild_masters.pyutilizesubprocess.runto invoke system tools includingffmpeg,ffprobe, andnode. These calls are used to perform video transformations (scaling, padding, frame rate adjustment), audio mixing, and launching the Playwright-based screenshot utility. - [EXTERNAL_DOWNLOADS]: The
build_endcard.pyscript generates an HTML template that references external font assets from Google Fonts (fonts.googleapis.comandfonts.gstatic.com). These are well-known services used for rendering the 'Playfair Display' font in the final video segments. - [DYNAMIC_EXECUTION]: The skill performs dynamic rendering by generating temporary HTML documents that incorporate background images and user-provided headlines. These documents are rendered into PNG files via a headless Chromium browser managed by Playwright (
scripts/shoot.js). - [INDIRECT_PROMPT_INJECTION]: The skill possesses an ingestion surface through CLI arguments (like
--headline) and configuration files (config.json). It mitigates potential injection risks in the rendering pipeline by usinghtml.escapeto sanitize text before it is inserted into the HTML template used for the end card.
Audit Metadata