hunk-launch-video

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill is designed to execute a sequence of shell commands using /bin/bash, Bun, Node.js, and ffmpeg to drive a TUI and encode video frames.
  • [EXTERNAL_DOWNLOADS]: The setup process triggers the download of a Chromium browser binary using the command bunx playwright install chromium. This is an official download from the well-known Playwright/Microsoft service.
  • [PRIVILEGE_ESCALATION]: The documentation indicates that the command bunx playwright install-deps chromium may require elevated permissions (sudo) to install system-level libraries on Linux environments.
  • [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection by ingesting untrusted data from CHANGELOG.md and files within the examples/ directory to derive highlights and scene content.
  • Ingestion points: Reads CHANGELOG.md and source files in the examples/ directory to generate storyboards.
  • Boundary markers: None identified; instructions are derived directly from the distilled content of external files.
  • Capability inventory: Executes shell commands (bun, node, ffmpeg), performs file system writes in .video-work/, and initiates network downloads via Playwright.
  • Sanitization: None identified; the skill assumes the repository content is trusted for the purpose of video generation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 07:26 AM