frame-review

Pass

Audited by Gen Agent Trust Hub on Nov 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes multiple scripts (check_sync.py, look.py, energy_arc.py, verify_delivery.py, blind_review.py) that call ffmpeg and ffprobe via subprocess.run. These calls are used to perform technical audits of video files, such as checking frame rates, audio synchronization, and motion energy levels. All command executions are performed on local files.
  • [DYNAMIC_EXECUTION]: The smoke.mjs and chrome_lint.mjs scripts utilize a custom Chrome DevTools Protocol implementation to automate a browser. This involves executing JavaScript code within the browser context (Runtime.evaluate) to programmatically seek through the video and inspect DOM properties for quality assurance purposes.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input in the form of project source files (index.html) and video content. The results of these automated checks are returned to the agent's context. While this provides a surface for indirect injection, the skill specifically instructs the agent to act as a 'harsh motion director' and to validate findings against rendered evidence, mitigating the risk of accidental obedience to embedded data.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 9, 2026, 03:32 PM