site-reels
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
execFileSyncandspawnSyncto executeffmpegandffprobefor video encoding, generating seamless loops, and performing quality audits on recorded scenes. - [DYNAMIC_EXECUTION]: The
record.mjsandsnap.mjsscripts use Puppeteer'spage.evaluateandpage.evaluateOnNewDocumentfunctions to inject and execute JavaScript within the browser context to automate site interactions and hide user interface elements. - [DYNAMIC_EXECUTION]: The skill dynamically loads user-provided scene configuration files using the ESM
import()function, with the file path resolved from command-line arguments. - [DYNAMIC_EXECUTION]: A post-installation script
patch-timeweb.mjsprogrammatically modifies the source code of thetimewebdependency in the localnode_modulesdirectory to fix specific behavioral issues related to its virtual clock implementation. - [INDIRECT_PROMPT_INJECTION]: The skill interacts with external website content through browser automation, which technically creates an attack surface for indirect prompt injection.
- Ingestion points: Website navigation using
page.goto()inrecord.mjsandsnap.mjs. - Boundary markers: No specific delimiters or instructions to ignore embedded content are employed between the agent and the site content.
- Capability inventory: Capabilities include headful browser control, subprocess execution of
ffmpeg, and local file system write access for video and screenshot storage. - Sanitization: No sanitization or filtering of the website content is performed prior to browser rendering.
Audit Metadata