playgama-game-video
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes several system utilities to process media and manage its environment. This includes
ffmpegandffprobefor video and audio assembly,npmfor package installation, and operating system tools for draft voice generation, such assayon macOS,powershell.exeon Windows, andespeak-ngon Linux. - [EXTERNAL_DOWNLOADS]: The skill downloads external assets and libraries required for video rendering and automation. Specifically, it fetches the GSAP library from the JSDelivr CDN and installs the
puppeteerpackage from the NPM registry. - [REMOTE_CODE_EXECUTION]: The skill utilizes
npxto execute thehyperframesutility at runtime.hyperframesis a known tool used for rendering video content from web-based compositions. - [DYNAMIC_EXECUTION]: Dynamic code execution is used to drive browser automation and time simulation:
film.mjsexecutes user-provided JavaScript scripts (--setupand--each) within the Puppeteer browser context to control game behavior during filming.vclock.jsimplements a virtual clock for the browser environment, which includes a mock implementation of timers that usesevalto handle string-based callbacks, ensuring deterministic frame-by-frame rendering.- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect injection as it interacts with external web content.
- Ingestion points: The
--urlparameter infilm.mjsallows the agent to navigate to and process content from arbitrary web pages (games). - Boundary markers: No specific boundary markers or instructions to ignore embedded content were identified.
- Capability inventory: The skill can execute shell commands (
ffmpeg), perform network requests to various AI service providers, and execute JavaScript in the browser. - Sanitization: The skill does not perform sanitization on the content of the target URL, as it is designed to faithfully record the visual output of the page.
Audit Metadata