ibeia-motion-reels
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches brand assets from JSDelivr and the SVGL API in engine/logos.py. These are well-known services for developer icons and assets used as intended for video branding.
- [COMMAND_EXECUTION]: Executes FFmpeg for audio extraction, clip slicing, and visual verification in engine/audio-check.py, engine/sfx.py, and engine/tiras.sh. Commands are constructed safely using list arguments to avoid shell injection.
- [DYNAMIC_EXECUTION]: Generates HTML compositions from templates (template/gerar.py) and executes them in a headless browser via Puppeteer (engine/check-timeline.mjs) to verify animation integrity.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data. Ingestion points: Processes JSON transcripts and fetches remote SVG logo data in engine/logos.py and engine/audio-check.py. Boundary markers: None present for the processed data. Capability inventory: Access to subprocess.run (FFmpeg) and browser automation via puppeteer-core. Sanitization: Employs regex-based normalization of SVG content in engine/logos.py to prevent ID collisions and basic tag manipulation.
Audit Metadata