vid-motion-graphics
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local bash script (
export-video.sh) to manage the video rendering pipeline, passing user-derived parameters for duration and dimensions. - [EXTERNAL_DOWNLOADS]: The export process installs the
playwrightpackage and the Chromium browser from official registries to facilitate frame capture. - [DYNAMIC_EXECUTION]: The skill generates HTML and JavaScript at runtime to create the animation frames, which are then rendered within a headless browser environment.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied content briefs to generate code and file paths, presenting a potential injection surface.
- [INDIRECT_PROMPT_INJECTION]: Ingestion points: The
content_briefparameter inSKILL.md. - [INDIRECT_PROMPT_INJECTION]: Boundary markers: None present in the code generation templates.
- [INDIRECT_PROMPT_INJECTION]: Capability inventory: Local file writing, shell execution, and network access for assets.
- [INDIRECT_PROMPT_INJECTION]: Sanitization: The skill instructions provide a method for converting brief excerpts into kebab-case slugs for use in filenames.
Audit Metadata