appshot-videos
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill generates custom TypeScript (.tsx) files based on patterns found in the analyzed codebase. These generated scripts are executed within the Remotion framework to produce the final video output.- [COMMAND_EXECUTION]: To support its video generation workflow, the skill executes various shell commands to manage dependencies (npm install), control a local development server (npm run dev, lsof, kill), and invoke the rendering engine (npx remotion render).- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from the target application's source code, creating a potential surface for indirect prompt injection.
- Ingestion points: The codebase of the target application is scanned in Phase 1 to inform the narrative and visual design.
- Boundary markers: The skill does not define clear delimiters or specialized instructions to prevent the agent from being influenced by directives embedded in the source code.
- Capability inventory: The agent can write files to the local directory and execute shell commands to build and run the video project.
- Sanitization: No explicit sanitization or content validation is performed on the extracted source code data before it is used to generate the video creative plan.
Audit Metadata