homepage-video-assets
Pass
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill defines a sequence of shell operations for video processing, including the use of
bunx remotion,ffmpeg,avconvert, and file system operations (cp,cd). These commands are standard for the described purpose of media asset generation within the Remotion project. - [PROMPT_INJECTION]: The instructions use unvalidated placeholders (e.g.,
<asset>,<chrome-name>,<composition-id>) interpolated directly into shell commands. This creates a surface for indirect prompt injection or command injection if an attacker provides malicious values for these variables. - Ingestion points: User-supplied values for placeholders such as
<composition-id>,<asset>,<chrome-name>, and<safari-name>. - Boundary markers: Absent; the placeholders are directly embedded in shell command strings without delimiters or escaping instructions.
- Capability inventory: The skill utilizes shell execution capabilities including package runners (
bunx), media conversion tools (ffmpeg,avconvert), and file system access (cp). - Sanitization: Absent; there is no instruction for the agent to validate, sanitize, or escape the values provided for the placeholders before execution.
Audit Metadata