video-formats
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to install a required toolchain from the vendor's official GitHub repository using pip. Evidence:
pip install 'video-studio-engine[generate,vision] @ https://github.com/scrollmark/social-skills/archive/refs/heads/master.tar.gz'inSKILL.md. These resources originate from the identified vendor. - [REMOTE_CODE_EXECUTION]: The installation process for the toolchain (
pip install) involves downloading and executing setup code from the remote archive. Evidence:SKILL.mdidentifies this as a dependency for the Boil and PointerPopups formats. - [DYNAMIC_EXECUTION]: The Boil format supports a plugin-like mechanism where custom Python functions are defined in a local file (
boil_shapes.py) and executed by the drawing engine. Evidence:references/formats/boil.mddescribes this system, noting that the engine injects specific helpers and enforces constraints (no imports, no top-level code, noeval/open) to restrict the execution environment to drawing logic. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input during "Interview" rounds to structure video composition and render parameters.
- Ingestion points: User input provided during the interactive interview rounds defined in each format file (e.g.,
references/formats/explainer.mdRounds 1-3). - Boundary markers: None identified; instructions do not explicitly warn the model to ignore injection attempts within user-supplied content.
- Capability inventory: The skill uses the
video-studioCLI to generate assets, track motion, and render video scenes. - Sanitization: None identified in the instructional content.
Audit Metadata