embedded-captions
Warn
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The scripts scripts/render-and-composite.sh and scripts/render-theme.sh execute an optional file named _postfx.sh from the user-provided project directory if it is present. This allows for the execution of arbitrary shell commands.
- [EXTERNAL_DOWNLOADS]: The transcription process in scripts/transcribe.cjs uses uvx to download and run the whisperx package at runtime. Similarly, scripts/matte.cjs triggers the download of background removal model weights to the local cache.
- [PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection by ingesting speech data from user video files.
- Ingestion points: transcribe.cjs extracts audio to create transcript.json.
- Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands when transcript text is inserted into HTML templates.
- Capability inventory: The skill can execute shell commands via child_process and use a headless browser via puppeteer.
- Sanitization: The skill implements HTML character escaping via the escBr function in make-composition.cjs to prevent script injection in the rendering stage.
Audit Metadata