short-editing
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads a project template from the official Remotion-dev GitHub repository (
https://github.com/remotion-dev/template-tiktok). This is a well-known source for video-as-code development tools. - [COMMAND_EXECUTION]: The skill executes system commands via
ffmpegandffprobeto perform video analysis, transcoding, and audio leveling, which are essential to its primary function. - [DYNAMIC_EXECUTION]: Local Node.js execution (
node -e) is used for data formatting tasks, such as generating SRT subtitle files and calculating video cut ranges from JSON transcription data. - [INDIRECT_PROMPT_INJECTION]: The skill processes transcription data generated from external audio files, which represents a potential injection surface.
- Ingestion points:
public/<slug>.json(whisper.cpp transcription output) andvideo-agent/scripts/(user-provided scripts). - Boundary markers: None explicitly defined in the prompt templates.
- Capability inventory: Access to
ffmpeg,node,git, andnpxfor file manipulation and process execution. - Sanitization: The skill instructions include a manual review step where the agent is told to fix misheard words and verify the cut list before rendering, acting as a functional safeguard against corrupted or malicious transcription data.
Audit Metadata