ajiang-video-broll
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches font subsets from Google Fonts APIs.
- The scripts
scripts/fetch_fonts.pyandassets/starter/scripts/fetch-fonts.mjsdownload.woff2files fromfonts.googleapis.combased on the characters used in the video scenes. This is standard practice for web-based rendering engines to ensure consistent typography without runtime internet dependency. - [COMMAND_EXECUTION]: Executes system commands for media processing and project setup.
scripts/init_project.pyrunsnpm installto set up the Remotion environment andffmpegto extract audio from source videos.- Multiple scripts (
srt_segments.py,extract_clips.py,broll_audio.py) useffmpegandffprobeto process media metadata and generate video/audio assets. assets/gallery/qa.pyexecutes a headless browser (Google Chrome) to generate automated screenshot previews for theme validation.- [DYNAMIC_EXECUTION]: Resolves video scene logic through Node.js execution.
scripts/build_broll.pyandassets/gallery/build.pyexecute Node.js snippets usingsubprocess.run(['node', '-e', ...]). This mechanism is used to interpret local JavaScript scene definitions and theme layouts, converting them into a structured timeline for the rendering engine.- [INDIRECT_PROMPT_INJECTION]: Processes external SRT subtitle data for rendering.
- Subtitle text from user-provided SRT files is parsed and rendered as visual elements (titles, captions) in the video. The skill assumes the data enters the context via subtitle files and provides a correction workflow to handle transcription errors, but does not execute instructions found within the text.
Audit Metadata