create-kinetic-typography
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell commands via
ffmpegfor concatenating images and muxing video files. Specifically, it uses the-f concatand-safe 0flags to process locally generated PNG sequences. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted text content from users to be rendered into kinetic typography. While this is a data ingestion surface, the rendering to a pixel-based format (PNG) serves as a functional boundary for the text data.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses local system font paths such as
/System/Library/Fonts/Supplemental/Impact.ttfto perform its primary function. No sensitive user data access or external network exfiltration was detected. - [DYNAMIC_EXECUTION]: The skill generates a temporary file list (
list.txt) and a sequence of PNG images which are then executed upon by a shell-based tool (ffmpeg) to produce the final video artifact.
Audit Metadata