scrollcraft

Pass

Audited by Gen Agent Trust Hub on Aug 24, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill integrates with the kie.ai API (api.kie.ai) to generate and upload visual assets (images and video). Users are instructed to provide their own API key via an environment variable or a .env file, which is a standard and safe practice for developer tools.
  • [COMMAND_EXECUTION]: Several utility scripts (Node.js and Bash) are used to manage the build pipeline. These include doctor.mjs for environment checks, encode.sh for processing video with FFmpeg, and shoot.mjs for automated testing using Playwright. These commands are executed locally within the project workspace to perform their documented functions.
  • [DATA_EXPOSURE]: The skill's scripts access local project metadata, such as searching for a .git directory to identify the project root or reading a local .env file for configuration. These operations are limited to the user's local workspace and are typical for development tools.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user input through an initial interview process to generate a BRIEF.md file. While this file serves as instructions for the agent's creative process, the skill is designed to faithfully translate user intent into a landing page design. The risk of unintended instruction execution is minimal and managed by standard agent guardrails.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 24, 2026, 10:26 PM