render-offer-ad
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The Python driver (
scripts/render.py) usessubprocess.runto executenpm install,npx remotion render, andffmpeg. These commands are essential for the skill's stated purpose of managing project dependencies and rendering video assets. All commands use the list-of-arguments format, which avoids shell-related injection vulnerabilities. - [EXTERNAL_DOWNLOADS]: The skill automatically performs a one-time installation of necessary React and Remotion libraries from the official npm registry if they are not already present. This is a standard and safe procedure for a development-focused rendering tool.
- [SAFE]: The skill processes a local configuration file to identify image and audio assets for inclusion in the video. It performs basic validation to ensure files exist before attempting to stage them within the project directory. No evidence of unauthorized network exfiltration or credential harvesting was found.
Audit Metadata