launch-film

Pass

Audited by Gen Agent Trust Hub on Sep 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a variety of local Node.js, Python, and Bash scripts to manage the film production pipeline. These scripts use sub-processes to run system-level tools such as ffmpeg and ffprobe for video encoding, frame analysis, and audio synthesis.\n- [DYNAMIC_EXECUTION]: The core rendering engine in engine/film.html employs await import() to dynamically load JavaScript modules, known as 'plans', from paths provided via URL parameters. This allows for flexible rendering logic but involves the runtime execution of code from dynamically determined paths.\n- [INDIRECT_PROMPT_INJECTION]: The skill features capabilities to navigate to and capture content from external URLs using Playwright. This represents an indirect injection surface where content from third-party websites is brought into the agent's processing environment.\n- [EXTERNAL_DOWNLOADS]: The skill references external assets, specifically fonts, from well-known and trusted sources like cdn.jsdelivr.net. These downloads are documented for transparency and are consistent with standard web development practices.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 27, 2026, 09:39 PM