animation-export-presets

Pass

Audited by Gen Agent Trust Hub on Sep 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes external binaries including ffmpeg, ffprobe, and npx remotion using the subprocess.run method within scripts/render.py and scripts/check_output.py. Execution follows security best practices by utilizing list-based arguments and ensuring shell=False is used, mitigating command injection vectors. Command parameters are primarily sourced from a bundled assets/presets.json file or derived from project-local configuration files.
  • [EXTERNAL_DOWNLOADS]: The assets/presets.json file contains reference links to official documentation from well-known services including LinkedIn, Microsoft, and Remotion. These external references provide delivery specifications.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from project files to configure its rendering and checking logic. 1. Ingestion points: storyboard.json and animation.config.json are read from the project directory. 2. Boundary markers: Absent. 3. Capability inventory: Execution of ffmpeg and npx with parameters derived from these files. 4. Sanitization: The Python scripts apply type validation and casting (e.g., int() for fps, width, and height) to values retrieved from the JSON configuration files before they are used in command construction.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 8, 2026, 12:48 PM