changelog-to-video
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and parse external changelogs, release notes, and shipped feature lists to generate video content.
- Ingestion points: The pipeline in
SKILL.mdexplicitly parses external text data (date, tag, title, description) from changelogs. - Boundary markers: The instructions do not specify the use of delimiters or specific warnings to the agent to disregard instructions embedded within the processed data.
- Capability inventory: The workflow utilizes Playwright for web capture and various engines for HTML/GSAP motion rendering.
- Sanitization: No specific validation or sanitization steps are described for the input data before it influences the asset resolution or scene composition logic.
- [EXTERNAL_DOWNLOADS]: The documentation references the installation of the skill and the retrieval of external assets during the execution of the workflow.
- The installation command in
README.mdfetches the skill from the vendor's official package repository. - The asset waterfall process in
SKILL.mdutilizes Playwright to navigate to and capture screenshots from public routes derived from the input feature list.
Audit Metadata