video-add-content-cards

Pass

Audited by Gen Agent Trust Hub on Oct 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The build_review_page.py script executes the ffmpeg binary using the subprocess module to extract frame snapshots from video files. This is a primary function of the skill used to generate the candidate review interface.
  • [COMMAND_EXECUTION]: The shoot.mjs utility script uses puppeteer-core to automate a local instance of Chrome. This is used for generating static snapshots of the animation themes for the gallery.
  • [COMMAND_EXECUTION]: The instructions in SKILL.md direct the AI agent to execute native system commands (Start-Process in PowerShell, open on macOS, and xdg-open on Linux) to open local HTML preview files. This is a standard pattern for facilitating human review of generated assets.
  • [EXTERNAL_DOWNLOADS]: The skill uses npx to invoke the hyperframes renderer, which may fetch the tool from the official npm registry if it is not cached locally.
  • [EXTERNAL_DOWNLOADS]: The animation templates in the examples/ directory reference CSS and font assets from well-known Google Fonts domains (fonts.googleapis.com and fonts.gstatic.com).
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted transcript data and semantic analysis results from the understanding.json file. While this represents a potential injection surface, the risk is mitigated by the skill's workflow, which requires the user to manually review, edit, and approve all generated copy before it is applied to the project plan.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 23, 2026, 11:30 AM