scroll-promo-site-builder
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill manages its project dependencies using standard package managers and official registries.\n
- Evidence: The
assets/site-template/package.jsonfile specifies well-known, versioned libraries such asreactandvite.\n - Evidence: Handoff scripts like
assets/handoff-templates/start-mac.commandandstart-windows.batinclude commands to runnpm installfor setting up the local environment.\n- [COMMAND_EXECUTION]: The workflow incorporates automated scripts to validate and process video assets locally.\n - Evidence:
scripts/probe_videos.pyandscripts/build_review_sequence.pyutilize the Pythonsubprocessmodule to executeffprobeandffmpegfor media analysis and concatenation.\n - Evidence: Utility shell scripts, including
encode_web_video.shandextract_boundary_frames.sh, useffmpegto perform encoding tasks and extract frames for continuity review.\n- [DYNAMIC_EXECUTION]: The skill facilitates the creation and execution of a local web application.\n - Evidence: It uses the Vite build tool and development server to provide a local preview of the React-based promo site.\n- [PROMPT_INJECTION]: The skill includes an indirect prompt injection surface as it ingests external product materials and reference webpages.\n
- Evidence: Step 0 of the workflow in
SKILL.mdinstructs the agent to collect product sources and reference webpages or videos, which are then used to inform the creative process. However, the skill implements strict phase gates and specific model binding requirements that mitigate risks associated with untrusted data ingestion.
Audit Metadata