montage-visual

Pass

Audited by Gen Agent Trust Hub on Sep 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes ffmpeg to generate diagnostic frames and grid overlays. This is a standard procedure used to verify that the video layout and safe zones are correctly configured before final rendering.
  • [DYNAMIC_EXECUTION]: The rendering pipeline relies on HyperFrames, which generates HTML and CSS content and executes GSAP animations within a headless Chrome environment. This dynamic assembly and execution of code is the primary method for producing the final MP4 video files.
  • [EXTERNAL_DOWNLOADS]: The skill documentation references and instructs the use of external assets from well-known and reputable sources, including shadcn/ui, Tremor, and various SVG icon repositories on GitHub. These downloads are used to provide UI components and logos for the video overlays.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data such as speech-to-text transcripts, competitor media, and user-provided configuration files. While this creates a theoretical surface for indirect prompt injection via malicious input data, the skill includes manual verification steps and strictly limits the output to contents found within the transcripts.
  • Ingestion points: Reads transcription files (pure words and timestamps) and external video media (чистовик.mp4, competitor screencasts).
  • Boundary markers: Explicitly instructs the agent to only use text derived from the author's speech for on-screen elements.
  • Capability inventory: Uses ffmpeg for frame extraction and headless Chrome for rendering.
  • Sanitization: Relies on specific word-matching algorithms and human-in-the-loop review for transcript corrections.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 24, 2026, 05:26 PM