vfx-video

Pass

Audited by Gen Agent Trust Hub on Aug 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The engine uses subprocess.Popen in vfxkit/comp.py to interface with ffmpeg. This is used to pipe raw video frames for encoding into MP4 files. The command uses a list of arguments and does not invoke a shell, following security best practices for process execution.
  • [EXTERNAL_DOWNLOADS]: The scripts/setup.sh script installs required dependencies including numpy, scipy, and Pillow via pip. It also attempts to install the ffmpeg system utility using official package managers like Homebrew or APT. These operations are limited to standard, well-known software registries and are necessary for the skill's functionality.
  • [DYNAMIC_EXECUTION]: The skill employs importlib.util in scripts/render.py and scripts/check_comp.py to load user-defined composition scripts. This allows the AI agent to execute the visual logic defined in the local project files to generate the video frames, which is the intended design for user-defined animations.
  • [INDIRECT_PROMPT_INJECTION]: The skill follows a multi-stage workflow that ingests user requirements to generate code. While this creates a surface for indirect prompt injection, the engine relies on deterministic scientific computing and local pixel rendering. The instructions provide clear boundaries and automated self-check scripts to validate output before final rendering, which serves as a safety mitigation.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 26, 2026, 03:10 AM
Security Audit — agent-trust-hub — vfx-video