project-showcase
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFENO_CODECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [NO_CODE]: The skill consists entirely of Markdown documentation and does not include any executable scripts, binaries, or configuration files that run code.
- [COMMAND_EXECUTION]: The skill mentions using the
ffmpegcommand-line utility for generating video poster images (ffmpeg -ss <time> -i clip.mp4 -frames:v 1 poster.png). This is a standard media processing task and is used within the context of the skill's primary purpose. - [PROMPT_INJECTION]: The skill contains an indirect prompt injection surface by design, as it ingests and processes existing project data and user input to generate new site content.
- Ingestion points: User interview responses and existing project data files as described in SKILL.md (Steps 1 and 2).
- Boundary markers: Absent; the instructions do not explicitly mandate the use of delimiters or instructions to ignore embedded commands within the external data.
- Capability inventory: The agent is tasked with generating code, writing layout components (SKILL.md), and potentially executing commands like
ffmpeg(patterns.md) based on the ingested data. - Sanitization: Absent; no specific sanitization or validation of the ingested project data is described.
Audit Metadata