studio-loop

Pass

Audited by Gen Agent Trust Hub on Nov 11, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes standard command-line tools including git and gh (GitHub CLI) for version control and pull request management. It also uses bunx to launch the development environment (remotion studio). These operations are consistent with the skill's primary purpose of software development and maintenance.
  • [INDIRECT_PROMPT_INJECTION]: The skill interacts with external data through UI actions (file uploads) and repository file inspection. These represent potential ingestion surfaces for untrusted content.
  • Ingestion points: File uploads, UI state readback via Playwright, and local source code files.
  • Boundary markers: The skill does not define specific delimiters for untrusted file content, though it relies on standard developer review workflows.
  • Capability inventory: The agent can write to the filesystem, execute shell commands (git, gh, bunx), and control a browser via Playwright.
  • Sanitization: Not explicitly mentioned for external file metadata or UI content, though Git history provides a clear audit trail of all changes.
  • [EXTERNAL_DOWNLOADS]: The skill uses bunx to execute the remotion package and references react-scan for performance monitoring. These are well-known packages in the React and Remotion ecosystems and are appropriate for the intended development workflow.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 11, 2026, 01:47 AM