playgama-game-video

Pass

Audited by Gen Agent Trust Hub on Oct 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes several system utilities to process media and manage its environment. This includes ffmpeg and ffprobe for video and audio assembly, npm for package installation, and operating system tools for draft voice generation, such as say on macOS, powershell.exe on Windows, and espeak-ng on Linux.
  • [EXTERNAL_DOWNLOADS]: The skill downloads external assets and libraries required for video rendering and automation. Specifically, it fetches the GSAP library from the JSDelivr CDN and installs the puppeteer package from the NPM registry.
  • [REMOTE_CODE_EXECUTION]: The skill utilizes npx to execute the hyperframes utility at runtime. hyperframes is a known tool used for rendering video content from web-based compositions.
  • [DYNAMIC_EXECUTION]: Dynamic code execution is used to drive browser automation and time simulation:
  • film.mjs executes user-provided JavaScript scripts (--setup and --each) within the Puppeteer browser context to control game behavior during filming.
  • vclock.js implements a virtual clock for the browser environment, which includes a mock implementation of timers that uses eval to handle string-based callbacks, ensuring deterministic frame-by-frame rendering.
  • [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect injection as it interacts with external web content.
  • Ingestion points: The --url parameter in film.mjs allows the agent to navigate to and process content from arbitrary web pages (games).
  • Boundary markers: No specific boundary markers or instructions to ignore embedded content were identified.
  • Capability inventory: The skill can execute shell commands (ffmpeg), perform network requests to various AI service providers, and execute JavaScript in the browser.
  • Sanitization: The skill does not perform sanitization on the content of the target URL, as it is designed to faithfully record the visual output of the page.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 18, 2026, 05:51 PM