animation-frame-qa
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/qa_frames.pyexecutes system binariesffmpegandffprobeusingsubprocess.run. It mitigates command injection risks by passing arguments as a list rather than a shell string, using timeouts, and validating numeric inputs before inclusion in command strings. - [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted external data.
- Ingestion points: Video files,
storyboard.jsonmetadata, and CLI-based review status updates inscripts/qa_frames.py. - Boundary markers: Boundary markers are not used for binary media, but JSON parsing is restricted to expected schemas.
- Capability inventory: The script has capabilities to write to the file system and execute subprocesses (
ffmpeg,ffprobe). - Sanitization: Inputs are sanitized via strict type checking (integers for frames/dimensions), regex validation for identifiers (
[a-z][a-z0-9-]{0,31}), and membership tests for status updates against a predefined set of allowed values.
Audit Metadata