import-canvas-capture
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using
bunxandnodeto run the Remotion CLI, which performs automated project modifications. - [INDIRECT_PROMPT_INJECTION]: The workflow ingests external capture files (
.webm) containing metadata which influences code modifications and dependency installations, presenting an attack surface if the input files are malicious. - Ingestion points: Path to
capture.webm(SKILL.md). - Boundary markers: None specified for the embedded metadata.
- Capability inventory: Executes shell commands, modifies source files, and installs NPM packages (SKILL.md).
- Sanitization: Not explicitly mentioned.
- [EXTERNAL_DOWNLOADS]: The skill triggers the installation of official vendor Node.js packages, specifically
@remotion/mediaand@remotion/mac-cursors, via the project's package manager.
Audit Metadata