promo-video
Pass
Audited by Gen Agent Trust Hub on Apr 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes Playwright and FFmpeg for video capture and encoding. It provides installation commands for these well-known developer tools via official package managers like npm and brew.\n- [COMMAND_EXECUTION]: Automates the video production pipeline by executing shell commands for browser automation and media processing.\n- [COMMAND_EXECUTION]: Dynamically generates a local JavaScript capture script and utilizes a provided bash script to tailor the recording process to the specific project's needs.\n- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface. Ingestion points: Reads local project files such as GameScene.js to identify game logic identifiers. Boundary markers: The instructions lack explicit delimiters for the source code read. Capability inventory: Executing generated JavaScript and running shell commands for FFmpeg. Sanitization: The script template uses hardcoded function bodies (e.g., () => {}) for logic overrides, preventing the execution of untrusted logic extracted from source files.
Audit Metadata