brand-launch-video-star
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes local shell commands for project initialization (
npx create-vibe-motion), asset validation (node scripts/validate-assets.mjs), and video rendering (pnpm exec remotion). These operations are essential for the skill's primary function and are performed using standard, trusted developer tools. - [EXTERNAL_DOWNLOADS]: The workflow involves fetching official brand assets (logos, imagery) from verified company domains and media kits. These downloads are guided by a strict authenticity policy and manifest system to ensure all remote content is sourced from trusted, official providers.
- [DATA_EXPOSURE]: The validation script (
validate-assets.mjs) reads local files to compute SHA-256 checksums for integrity verification. While it accesses the file system, it does so within the scope of the project directory to ensure the correct versions of brand assets are used during the rendering process. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to browse and extract data from official company websites. While this creates a surface for processing untrusted content, the risk is mitigated by the skill's narrow focus on structured brand data (colors, fonts, logos) and the deterministic nature of the video rendering engine.
Audit Metadata