short-editing

Pass

Audited by Gen Agent Trust Hub on Oct 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads a project template from the official Remotion-dev GitHub repository (https://github.com/remotion-dev/template-tiktok). This is a well-known source for video-as-code development tools.
  • [COMMAND_EXECUTION]: The skill executes system commands via ffmpeg and ffprobe to perform video analysis, transcoding, and audio leveling, which are essential to its primary function.
  • [DYNAMIC_EXECUTION]: Local Node.js execution (node -e) is used for data formatting tasks, such as generating SRT subtitle files and calculating video cut ranges from JSON transcription data.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes transcription data generated from external audio files, which represents a potential injection surface.
  • Ingestion points: public/<slug>.json (whisper.cpp transcription output) and video-agent/scripts/ (user-provided scripts).
  • Boundary markers: None explicitly defined in the prompt templates.
  • Capability inventory: Access to ffmpeg, node, git, and npx for file manipulation and process execution.
  • Sanitization: The skill instructions include a manual review step where the agent is told to fix misheard words and verify the cut list before rendering, acting as a functional safeguard against corrupted or malicious transcription data.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 15, 2026, 07:02 AM