web-sims
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes local command-line tools, including Node.js, Python 3, and ffmpeg, to run build and capture scripts (
sims/build.mjs,sims/capture.mjs,sims/<name>/sound.py). These commands are necessary for the skill's primary function of simulation rendering and audio generation. - [INDIRECT_PROMPT_INJECTION]: The skill defines a data ingestion surface through the use of a
timeline.jsonfile to coordinate video beats. - Ingestion points:
timeline.json(referenced inSKILL.md). - Boundary markers: None explicitly defined in the instructions.
- Capability inventory: Local script execution (
node,python3) and file output (ffmpeg). - Sanitization: Not explicitly documented; however, the file is used for internal build coordination rather than processing untrusted external content, which minimizes the associated risk.
Audit Metadata