render-offer-ad

Pass

Audited by Gen Agent Trust Hub on Jul 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The Python driver (scripts/render.py) uses subprocess.run to execute npm install, npx remotion render, and ffmpeg. These commands are essential for the skill's stated purpose of managing project dependencies and rendering video assets. All commands use the list-of-arguments format, which avoids shell-related injection vulnerabilities.
  • [EXTERNAL_DOWNLOADS]: The skill automatically performs a one-time installation of necessary React and Remotion libraries from the official npm registry if they are not already present. This is a standard and safe procedure for a development-focused rendering tool.
  • [SAFE]: The skill processes a local configuration file to identify image and audio assets for inclusion in the video. It performs basic validation to ensure files exist before attempting to stage them within the project directory. No evidence of unauthorized network exfiltration or credential harvesting was found.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 15, 2026, 09:42 AM
Security Audit — agent-trust-hub — render-offer-ad