site-reels

Pass

Audited by Gen Agent Trust Hub on Nov 2, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes execFileSync and spawnSync to execute ffmpeg and ffprobe for video encoding, generating seamless loops, and performing quality audits on recorded scenes.
  • [DYNAMIC_EXECUTION]: The record.mjs and snap.mjs scripts use Puppeteer's page.evaluate and page.evaluateOnNewDocument functions to inject and execute JavaScript within the browser context to automate site interactions and hide user interface elements.
  • [DYNAMIC_EXECUTION]: The skill dynamically loads user-provided scene configuration files using the ESM import() function, with the file path resolved from command-line arguments.
  • [DYNAMIC_EXECUTION]: A post-installation script patch-timeweb.mjs programmatically modifies the source code of the timeweb dependency in the local node_modules directory to fix specific behavioral issues related to its virtual clock implementation.
  • [INDIRECT_PROMPT_INJECTION]: The skill interacts with external website content through browser automation, which technically creates an attack surface for indirect prompt injection.
  • Ingestion points: Website navigation using page.goto() in record.mjs and snap.mjs.
  • Boundary markers: No specific delimiters or instructions to ignore embedded content are employed between the agent and the site content.
  • Capability inventory: Capabilities include headful browser control, subprocess execution of ffmpeg, and local file system write access for video and screenshot storage.
  • Sanitization: No sanitization or filtering of the website content is performed prior to browser rendering.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 2, 2026, 04:43 PM