overlays
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill orchestrates a video editing pipeline by executing various local Python and Node.js scripts, including
plan.py,edit.py,capture.mjs,check.py, andmatte.py. These scripts are part of the plugin's internal library. - [EXTERNAL_DOWNLOADS]: The skill utilizes
capture.mjsto fetch external content, such as web captures, logos, and social media posts, which are required for generating video overlays. This involves active network requests to user-specified or prompt-derived URLs. - [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its reliance on external web content which is processed and integrated into the video editing workflow.
- Ingestion points: External web pages, logos, and UI elements fetched via the
capture.mjstool. - Boundary markers: There are no explicit instructions or delimiters provided to the agent to treat fetched external content as untrusted or to ignore potential instructions embedded within that content.
- Capability inventory: The skill can execute local shell commands (Python and Node.js), write to project configuration files (
visuals.json,images.json), and perform network operations. - Sanitization: The skill description does not specify any sanitization, filtering, or validation steps for the metadata or content retrieved from external URLs before it is processed by the agent or sub-agents.
Audit Metadata