video-add-captions
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto fetch thehyperframesrendering package and initiates a download of thechrome-headless-shellbinary to a local cache. - [COMMAND_EXECUTION]: Several scripts execute shell commands, including
ffmpegandffprobefor media extraction and metadata probing, andnpxfor rendering. The scriptscripts/caption_interaction.mjsusespowershell.exeto launch default browser handlers for generated HTML review pages. - [DYNAMIC_EXECUTION]: The skill constructs HTML files at runtime that execute animations using the GSAP library based on data generated during the caption planning phase.
- [INDIRECT_PROMPT_INJECTION]: The skill processes transcripts and project metadata that enter the agent's context from external files.
- Ingestion points:
scripts/build_captions.pyreads transcript.json andscripts/caption_spatial_context.pyreads project metadata. - Boundary markers: The skill implements a SHA-256 hash validation mechanism in
scripts/caption_interaction_state.mjsto verify integrity across different stages of the workflow. - Capability inventory: The skill has the capability to write to the local filesystem, execute shell commands, and fetch external packages via standard registries.
- Sanitization: The generator script performs HTML escaping on caption text and utilizes structured JSON parsing to mitigate malicious content in input files.
Audit Metadata