vidtsx-2d-generator
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions require the agent to execute shell commands to verify its output, specifically mentioning the execution of
node scripts/render-all.mjsandffmpegfor frame extraction within the verification step. - [DYNAMIC_EXECUTION]: The agent follows a workflow where it generates React-based video components from user input and is then directed to render (execute) those components locally to verify their appearance, representing a generate-and-run pattern.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user descriptions to generate executable code, presenting a vulnerability surface where malicious input could influence the generated TSX file.
- Ingestion points: Video, scene, or shot descriptions provided by the user in natural language to guide the generation of the video file.
- Boundary markers: No specific delimiters or boundary instructions are defined to separate user content from the code generation logic or to instruct the agent to ignore potentially malicious embedded instructions.
- Capability inventory: The agent possesses the capability to write files and execute local shell commands for rendering and video processing.
- Sanitization: The skill does not specify any sanitization or validation logic for user-provided descriptions before they are interpolated into the generated TSX component.
Audit Metadata