video-add-captions

Pass

Audited by Gen Agent Trust Hub on Oct 23, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses npx to fetch the hyperframes rendering package and initiates a download of the chrome-headless-shell binary to a local cache.
  • [COMMAND_EXECUTION]: Several scripts execute shell commands, including ffmpeg and ffprobe for media extraction and metadata probing, and npx for rendering. The script scripts/caption_interaction.mjs uses powershell.exe to launch default browser handlers for generated HTML review pages.
  • [DYNAMIC_EXECUTION]: The skill constructs HTML files at runtime that execute animations using the GSAP library based on data generated during the caption planning phase.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes transcripts and project metadata that enter the agent's context from external files.
  • Ingestion points: scripts/build_captions.py reads transcript.json and scripts/caption_spatial_context.py reads project metadata.
  • Boundary markers: The skill implements a SHA-256 hash validation mechanism in scripts/caption_interaction_state.mjs to verify integrity across different stages of the workflow.
  • Capability inventory: The skill has the capability to write to the local filesystem, execute shell commands, and fetch external packages via standard registries.
  • Sanitization: The generator script performs HTML escaping on caption text and utilizes structured JSON parsing to mitigate malicious content in input files.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 23, 2026, 11:31 AM