overlays

Pass

Audited by Gen Agent Trust Hub on Oct 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill orchestrates a video editing pipeline by executing various local Python and Node.js scripts, including plan.py, edit.py, capture.mjs, check.py, and matte.py. These scripts are part of the plugin's internal library.
  • [EXTERNAL_DOWNLOADS]: The skill utilizes capture.mjs to fetch external content, such as web captures, logos, and social media posts, which are required for generating video overlays. This involves active network requests to user-specified or prompt-derived URLs.
  • [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its reliance on external web content which is processed and integrated into the video editing workflow.
  • Ingestion points: External web pages, logos, and UI elements fetched via the capture.mjs tool.
  • Boundary markers: There are no explicit instructions or delimiters provided to the agent to treat fetched external content as untrusted or to ignore potential instructions embedded within that content.
  • Capability inventory: The skill can execute local shell commands (Python and Node.js), write to project configuration files (visuals.json, images.json), and perform network operations.
  • Sanitization: The skill description does not specify any sanitization, filtering, or validation steps for the metadata or content retrieved from external URLs before it is processed by the agent or sub-agents.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 24, 2026, 11:17 AM