after-effects
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides patterns for executing shell commands via the
aerenderCLI for headless rendering andosascriptfor triggering script execution within the macOS environment. - [DYNAMIC_EXECUTION]: The skill utilizes Adobe's
evalScriptandevalFilemethods to dynamically execute ExtendScript code. This is the standard mechanism for Adobe CEP/UXP panel communication but involves the runtime execution of script blocks. - [INDIRECT_PROMPT_INJECTION]: The skill demonstrates workflows that ingest external data (such as CSV files) to drive motion graphics automation. This creates a surface where external content could potentially influence agent behavior or script execution.
- Ingestion points: Data read from external files via the
readCSVplaceholder function inSKILL.md. - Boundary markers: None identified in the provided ExtendScript or Bash templates to isolate or delimit untrusted data.
- Capability inventory: File system access (read/write), project manipulation, and network notifications via
curl(as described in Example 2). - Sanitization: The skill does not demonstrate explicit sanitization or validation of imported data before it is applied to composition properties.
Audit Metadata