create-apple-notes-video-ad

Pass

Audited by Gen Agent Trust Hub on Aug 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses child_process.execSync in Node.js and subprocess.run in Python to invoke ffmpeg and ffprobe. These operations are used to render still images into video, loop segments, and mix audio tracks to produce the final ad master.
  • [DYNAMIC_EXECUTION]: The skill employs dynamic JavaScript execution within a browser environment via Playwright to drive the typing animation at runtime. It also executes an inline Python script within a shell script to perform complex audio mixing logic based on a generated cue list.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text and timing data through a structured note.json file.
  • Ingestion points: The note.json file is loaded by the loadSpec function in record-master.template.js and render-end-card.template.js.
  • Boundary markers: The skill relies on the JSON object structure as the boundary for incoming data; no specific security delimiters or markers are implemented for the embedded text.
  • Capability inventory: The skill can execute shell commands, perform browser automation, and write files to the local system.
  • Sanitization: The tagTypedParagraphs function in the recording script performs HTML entity escaping on paragraph text before it is inserted into the rendering template.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 19, 2026, 04:39 PM
Security Audit — agent-trust-hub — create-apple-notes-video-ad