changelog-to-video

Pass

Audited by Gen Agent Trust Hub on Sep 24, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and parse external changelogs, release notes, and shipped feature lists to generate video content.
  • Ingestion points: The pipeline in SKILL.md explicitly parses external text data (date, tag, title, description) from changelogs.
  • Boundary markers: The instructions do not specify the use of delimiters or specific warnings to the agent to disregard instructions embedded within the processed data.
  • Capability inventory: The workflow utilizes Playwright for web capture and various engines for HTML/GSAP motion rendering.
  • Sanitization: No specific validation or sanitization steps are described for the input data before it influences the asset resolution or scene composition logic.
  • [EXTERNAL_DOWNLOADS]: The documentation references the installation of the skill and the retrieval of external assets during the execution of the workflow.
  • The installation command in README.md fetches the skill from the vendor's official package repository.
  • The asset waterfall process in SKILL.md utilizes Playwright to navigate to and capture screenshots from public routes derived from the input feature list.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 24, 2026, 06:59 AM