vfx-video
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The engine uses
subprocess.Popeninvfxkit/comp.pyto interface withffmpeg. This is used to pipe raw video frames for encoding into MP4 files. The command uses a list of arguments and does not invoke a shell, following security best practices for process execution. - [EXTERNAL_DOWNLOADS]: The
scripts/setup.shscript installs required dependencies includingnumpy,scipy, andPillowviapip. It also attempts to install theffmpegsystem utility using official package managers like Homebrew or APT. These operations are limited to standard, well-known software registries and are necessary for the skill's functionality. - [DYNAMIC_EXECUTION]: The skill employs
importlib.utilinscripts/render.pyandscripts/check_comp.pyto load user-defined composition scripts. This allows the AI agent to execute the visual logic defined in the local project files to generate the video frames, which is the intended design for user-defined animations. - [INDIRECT_PROMPT_INJECTION]: The skill follows a multi-stage workflow that ingests user requirements to generate code. While this creates a surface for indirect prompt injection, the engine relies on deterministic scientific computing and local pixel rendering. The instructions provide clear boundaries and automated self-check scripts to validate output before final rendering, which serves as a safety mitigation.
Audit Metadata