scroll-video-website

Pass

Audited by Gen Agent Trust Hub on Aug 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes local media utilities to process video content and optimize assets.
  • Evidence: The skill instructs the agent to use ffprobe for metadata inspection and ffmpeg for frame extraction (SKILL.md). It also describes a workflow for trial-encoding frames using local encoders (references/optimize.md).
  • Context: These operations are intended for a local development environment and target the user-supplied video path.
  • Sanitization: The instructions include basic path validation and quoting requirements for filenames with spaces to prevent simple command injection errors.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface where untrusted data (video files and user directions) is processed to generate code and assets.
  • Ingestion points: Video file metadata via ffprobe, user-provided file paths, and optional styling/copy instructions in SKILL.md.
  • Boundary markers: The skill lacks explicit delimiters for user-provided instructions but requires the agent to interpret them within the specific scope of visual styling.
  • Capability inventory: File system access (read/write), shell command execution (ffmpeg, ffprobe), and JavaScript code generation for the frontend animation.
  • Sanitization: No specific input sanitization is defined for the textual styling instructions beyond general agent-level safety filters.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 24, 2026, 12:46 AM
Security Audit — agent-trust-hub — scroll-video-website