code-based-films
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes external binaries for media processing and testing.
tools/beatmap.pyusessubprocess.runto callffmpegandffprobefor music analysis.tools/encode.shinvokesffmpegfor final film assembly.engine/tests/extra.mjsandengine/tests/kit_check.mjsuseexecFileSyncto run internal project CLI tools.- [EXTERNAL_DOWNLOADS]: External dependencies are fetched from well-known sources.
setup.shusesnpm cito install pinned packages from the official npm registry.tools/rp_pod/setup.shfetches the Node.js runtime fromnodejs.organd verifies it using SHA256 checksums.- [DYNAMIC_EXECUTION]: Runtime code execution is used for path tracing and remote rendering workflows.
engine/src/host.mjsutilizespuppeteer-coreto drive headless Chrome for executing custom WGSL compute shaders on the GPU.tools/rpprovides a mechanism to synchronize project code and execute rendering tasks on remote Runpod GPU instances via SSH and rsync.- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data as part of its rendering pipeline.
- Ingestion points:
tools/beatmap.py(audio tracks) andengine/src/scene.mjs(scene JSON, PTM meshes, and PTV volume data). - Boundary markers: Absent; data is passed directly to specialized processing tools.
- Capability inventory:
subprocess.run(ffmpeg) intools/beatmap.py, browser-based shader execution inengine/src/host.mjs, and remote shell access intools/rp. - Sanitization: Absent; the skill relies on the robustness of the underlying tools (ffmpeg, Puppeteer) and its custom binary parsers to handle input safely.
Audit Metadata