frame-review
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes multiple scripts (
check_sync.py,look.py,energy_arc.py,verify_delivery.py,blind_review.py) that callffmpegandffprobeviasubprocess.run. These calls are used to perform technical audits of video files, such as checking frame rates, audio synchronization, and motion energy levels. All command executions are performed on local files. - [DYNAMIC_EXECUTION]: The
smoke.mjsandchrome_lint.mjsscripts utilize a custom Chrome DevTools Protocol implementation to automate a browser. This involves executing JavaScript code within the browser context (Runtime.evaluate) to programmatically seek through the video and inspect DOM properties for quality assurance purposes. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input in the form of project source files (
index.html) and video content. The results of these automated checks are returned to the agent's context. While this provides a surface for indirect injection, the skill specifically instructs the agent to act as a 'harsh motion director' and to validate findings against rendered evidence, mitigating the risk of accidental obedience to embedded data.
Audit Metadata