ui-animation
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runinscripts/extract_frames.pyto invoke theffmpegutility for processing video recordings. The implementation uses a list of arguments rather than a shell string, which is a security best practice that prevents command injection attacks. - [INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface through the ingestion of external data (video files and tracking metrics) but implements appropriate safeguards.
- Ingestion points: External media files are processed by
scripts/extract_frames.py, and tracking data is consumed byscripts/fit_curves.py. - Boundary markers: The instructions require the use of fresh, task-local output directories for each operation to prevent cross-contamination between projects.
- Capability inventory: The skill has capabilities including file system writes and subprocess execution via system tools (FFmpeg).
- Sanitization: Inputs are handled using standard library functions, and subprocess calls avoid shell expansion.
Audit Metadata