hunk-launch-video
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to execute a sequence of shell commands using
/bin/bash, Bun, Node.js, and ffmpeg to drive a TUI and encode video frames. - [EXTERNAL_DOWNLOADS]: The setup process triggers the download of a Chromium browser binary using the command
bunx playwright install chromium. This is an official download from the well-known Playwright/Microsoft service. - [PRIVILEGE_ESCALATION]: The documentation indicates that the command
bunx playwright install-deps chromiummay require elevated permissions (sudo) to install system-level libraries on Linux environments. - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection by ingesting untrusted data from
CHANGELOG.mdand files within theexamples/directory to derive highlights and scene content. - Ingestion points: Reads
CHANGELOG.mdand source files in theexamples/directory to generate storyboards. - Boundary markers: None identified; instructions are derived directly from the distilled content of external files.
- Capability inventory: Executes shell commands (
bun,node,ffmpeg), performs file system writes in.video-work/, and initiates network downloads via Playwright. - Sanitization: None identified; the skill assumes the repository content is trusted for the purpose of video generation.
Audit Metadata