code-based-films

Pass

Audited by Gen Agent Trust Hub on Oct 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes external binaries for media processing and testing.
  • tools/beatmap.py uses subprocess.run to call ffmpeg and ffprobe for music analysis.
  • tools/encode.sh invokes ffmpeg for final film assembly.
  • engine/tests/extra.mjs and engine/tests/kit_check.mjs use execFileSync to run internal project CLI tools.
  • [EXTERNAL_DOWNLOADS]: External dependencies are fetched from well-known sources.
  • setup.sh uses npm ci to install pinned packages from the official npm registry.
  • tools/rp_pod/setup.sh fetches the Node.js runtime from nodejs.org and verifies it using SHA256 checksums.
  • [DYNAMIC_EXECUTION]: Runtime code execution is used for path tracing and remote rendering workflows.
  • engine/src/host.mjs utilizes puppeteer-core to drive headless Chrome for executing custom WGSL compute shaders on the GPU.
  • tools/rp provides a mechanism to synchronize project code and execute rendering tasks on remote Runpod GPU instances via SSH and rsync.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data as part of its rendering pipeline.
  • Ingestion points: tools/beatmap.py (audio tracks) and engine/src/scene.mjs (scene JSON, PTM meshes, and PTV volume data).
  • Boundary markers: Absent; data is passed directly to specialized processing tools.
  • Capability inventory: subprocess.run (ffmpeg) in tools/beatmap.py, browser-based shader execution in engine/src/host.mjs, and remote shell access in tools/rp.
  • Sanitization: Absent; the skill relies on the robustness of the underlying tools (ffmpeg, Puppeteer) and its custom binary parsers to handle input safely.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 29, 2026, 02:50 PM