create-pause-and-click-explainer
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
ffmpegandffprobeCLI tools for video trimming, frame extraction, and final assembly. These commands are fundamental to the skill's purpose and are executed against local media files specified in the project brief. - [DYNAMIC_EXECUTION]: To manage complex visual compositing and audio mixing, the skill generates and executes local Python (
build_overlay_assets.py) and shell scripts (build_audio.sh). This is an architectural choice to manage logic that exceeds simple command-line arguments and is entirely consistent with automated video production workflows. - [DATA_EXPOSURE]: The skill reads from and writes to the local file system, specifically targeting media assets and project directories. It follows a structured 'canonical 5-folder layout' for project management, ensuring that file operations are predictable and confined to the task context.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted text data from a brief to generate video labels. While this represents a data ingestion surface, the text is rendered into static image overlays (PNGs) rather than being executed as instructions, which effectively neutralizes the risk of indirect injection.
Audit Metadata