product-video
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs
@vosjs/cliand@vosso/clivia npm, which are resources provided by the skill author for the core functionality of the tool.\n- [EXTERNAL_DOWNLOADS]: It downloads the Chromium browser usingnpx playwright install chromiumand fetches web dependencies such asthreeandmediabunnyfrom theesm.shcontent delivery network during the rendering phase.\n- [COMMAND_EXECUTION]: The instructions require the agent to execute various shell commands including thevosCLI for recording and planning, andffmpegfor post-processing and re-encoding video assets.\n- [PROMPT_INJECTION]: The skill is subject to indirect prompt injection risks because it directs the agent to interact with and process data from untrusted external websites.\n - Ingestion points: Target web pages explored via fetch or Playwright tools (SKILL.md, Step 1).\n
- Boundary markers: None identified; the instructions do not specify the use of delimiters or isolation techniques for external web data.\n
- Capability inventory: The agent has the ability to execute shell commands (
vos,ffmpeg,npm,npx), perform network operations, and write to the local file system (take directory).\n - Sanitization: There are no instructions for sanitizing or validating content fetched from external URLs before the agent processes it to identify selectors and plan actions.
Audit Metadata