launch-film
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a variety of local Node.js, Python, and Bash scripts to manage the film production pipeline. These scripts use sub-processes to run system-level tools such as
ffmpegandffprobefor video encoding, frame analysis, and audio synthesis.\n- [DYNAMIC_EXECUTION]: The core rendering engine inengine/film.htmlemploysawait import()to dynamically load JavaScript modules, known as 'plans', from paths provided via URL parameters. This allows for flexible rendering logic but involves the runtime execution of code from dynamically determined paths.\n- [INDIRECT_PROMPT_INJECTION]: The skill features capabilities to navigate to and capture content from external URLs using Playwright. This represents an indirect injection surface where content from third-party websites is brought into the agent's processing environment.\n- [EXTERNAL_DOWNLOADS]: The skill references external assets, specifically fonts, from well-known and trusted sources likecdn.jsdelivr.net. These downloads are documented for transparency and are consistent with standard web development practices.
Audit Metadata