web-product-demo-video

Pass

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes ffmpeg and ffprobe via Python's subprocess.run to render and validate video files. These calls use list-based arguments and resolve executable paths using shutil.which to minimize shell injection risks.
  • [DYNAMIC_EXECUTION]: render_video.py dynamically generates complex FFmpeg filter graphs and subtitle files (ASS format) based on the project's storyboard and configuration files.
  • [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves ingesting and processing data from external web applications and repository files, creating a potential surface for indirect instructions.
  • Ingestion points: Target web application UI (via Playwright automation) and repository documentation.
  • Boundary markers: The workflow enforces distinct phases (inspection, planning, validation, and rendering) with human-in-the-loop verification steps.
  • Capability inventory: Shell command execution for media processing, file system writes within isolated directories, and browser automation.
  • Sanitization: Includes path escaping for FFmpeg filters and mandates the use of environment variables for resolving sensitive authentication data.
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the playwright Node.js package from the official NPM registry.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 14, 2026, 10:25 PM