video-edit-pipeline
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill orchestrates video processing by invoking various external CLI tools. It uses
ffprobefor media metadata extraction,python3for project management via theeditor.pytool, andnpm/npxto run rendering and QA processes. These operations are essential to the skill's primary function of video editing. - [INDIRECT_PROMPT_INJECTION]: The skill implements a revision loop that fetches reviewer comments from an external canvas URL using
read-notes.mjs. This ingested content is then imported into the project state to guide modifications, representing a surface where external instructions could influence agent actions. - Ingestion points: External review canvas URLs processed by
read-notes.mjs(referenced inreferences/project-tools.md). - Boundary markers: The instructions do not specify any delimiters or warnings to isolate ingested review notes from the agent's core instruction set.
- Capability inventory: The skill has broad capabilities including file system writes, execution of shell commands (
python,npm,ffprobe), and video rendering viahyperframes. - Sanitization: No explicit sanitization, filtering, or validation of the ingested review JSON is described.
- [EXTERNAL_DOWNLOADS]: The skill utilizes
npxto execute thehyperframesrendering engine, which involves fetching and running packages from the npm registry. It also interacts with external REST APIs such asarcads-brollfor asset generation and thevideo-review-canvasservice for delivery and feedback collection. - [DYNAMIC_EXECUTION]: The orchestration workflow involves the runtime generation of storyboards and composition manifests (JSON, HTML, and JavaScript). These dynamically generated files are then interpreted by the
hyperframesengine to produce final rendered media.
Audit Metadata