seek-engine
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill retrieves assets from well-known public services:
- Fetches font families and font files from Google Fonts (fonts.googleapis.com).
- References elevation data tiles from AWS S3 buckets (s3.amazonaws.com/elevation-tiles-prod).
- [COMMAND_EXECUTION]: Local binaries are used for rendering and media processing:
- Spawns ffmpeg for video concatenation, audio mixing, and encoding.
- Spawns Chrome/Chromium via Node.js and the Chrome DevTools Protocol (CDP) for frame capture.
- [DYNAMIC_EXECUTION]: The skill uses browser automation to execute code during the render process:
- Utilizes page.evaluate and Runtime.evaluate to seek through animation timelines and retrieve scene information from the browser DOM.
- [INDIRECT_PROMPT_INJECTION]: The renderer supports data-driven animations via external JSON files, which is a common pattern for video templates:
- Ingestion points: render.mjs (reads files specified via --data).
- Boundary markers: Absent; data is injected into the global window.DATA object.
- Capability inventory: Scripts can spawn subprocesses (ffmpeg, chrome) and perform file system writes.
- Sanitization: Relies on standard browser security context.
Audit Metadata