studio-loop
Pass
Audited by Gen Agent Trust Hub on Nov 11, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes standard command-line tools including
gitandgh(GitHub CLI) for version control and pull request management. It also usesbunxto launch the development environment (remotion studio). These operations are consistent with the skill's primary purpose of software development and maintenance. - [INDIRECT_PROMPT_INJECTION]: The skill interacts with external data through UI actions (file uploads) and repository file inspection. These represent potential ingestion surfaces for untrusted content.
- Ingestion points: File uploads, UI state readback via Playwright, and local source code files.
- Boundary markers: The skill does not define specific delimiters for untrusted file content, though it relies on standard developer review workflows.
- Capability inventory: The agent can write to the filesystem, execute shell commands (git, gh, bunx), and control a browser via Playwright.
- Sanitization: Not explicitly mentioned for external file metadata or UI content, though Git history provides a clear audit trail of all changes.
- [EXTERNAL_DOWNLOADS]: The skill uses
bunxto execute theremotionpackage and referencesreact-scanfor performance monitoring. These are well-known packages in the React and Remotion ecosystems and are appropriate for the intended development workflow.
Audit Metadata