render-3d-product-showcase

Pass

Audited by Gen Agent Trust Hub on Aug 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The scripts build_endcard.py and build_masters.py utilize subprocess.run to invoke system tools including ffmpeg, ffprobe, and node. These calls are used to perform video transformations (scaling, padding, frame rate adjustment), audio mixing, and launching the Playwright-based screenshot utility.
  • [EXTERNAL_DOWNLOADS]: The build_endcard.py script generates an HTML template that references external font assets from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). These are well-known services used for rendering the 'Playfair Display' font in the final video segments.
  • [DYNAMIC_EXECUTION]: The skill performs dynamic rendering by generating temporary HTML documents that incorporate background images and user-provided headlines. These documents are rendered into PNG files via a headless Chromium browser managed by Playwright (scripts/shoot.js).
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses an ingestion surface through CLI arguments (like --headline) and configuration files (config.json). It mitigates potential injection risks in the rendering pipeline by using html.escape to sanitize text before it is inserted into the HTML template used for the end card.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 14, 2026, 05:21 AM
Security Audit — agent-trust-hub — render-3d-product-showcase