ajiang-video-broll

Pass

Audited by Gen Agent Trust Hub on Oct 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches font subsets from Google Fonts APIs.
  • The scripts scripts/fetch_fonts.py and assets/starter/scripts/fetch-fonts.mjs download .woff2 files from fonts.googleapis.com based on the characters used in the video scenes. This is standard practice for web-based rendering engines to ensure consistent typography without runtime internet dependency.
  • [COMMAND_EXECUTION]: Executes system commands for media processing and project setup.
  • scripts/init_project.py runs npm install to set up the Remotion environment and ffmpeg to extract audio from source videos.
  • Multiple scripts (srt_segments.py, extract_clips.py, broll_audio.py) use ffmpeg and ffprobe to process media metadata and generate video/audio assets.
  • assets/gallery/qa.py executes a headless browser (Google Chrome) to generate automated screenshot previews for theme validation.
  • [DYNAMIC_EXECUTION]: Resolves video scene logic through Node.js execution.
  • scripts/build_broll.py and assets/gallery/build.py execute Node.js snippets using subprocess.run(['node', '-e', ...]). This mechanism is used to interpret local JavaScript scene definitions and theme layouts, converting them into a structured timeline for the rendering engine.
  • [INDIRECT_PROMPT_INJECTION]: Processes external SRT subtitle data for rendering.
  • Subtitle text from user-provided SRT files is parsed and rendered as visual elements (titles, captions) in the video. The skill assumes the data enters the context via subtitle files and provides a correction workflow to handle transcription errors, but does not execute instructions found within the text.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 15, 2026, 02:48 PM