video-add-content-cards
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
build_review_page.pyscript executes theffmpegbinary using thesubprocessmodule to extract frame snapshots from video files. This is a primary function of the skill used to generate the candidate review interface. - [COMMAND_EXECUTION]: The
shoot.mjsutility script usespuppeteer-coreto automate a local instance of Chrome. This is used for generating static snapshots of the animation themes for the gallery. - [COMMAND_EXECUTION]: The instructions in
SKILL.mddirect the AI agent to execute native system commands (Start-Processin PowerShell,openon macOS, andxdg-openon Linux) to open local HTML preview files. This is a standard pattern for facilitating human review of generated assets. - [EXTERNAL_DOWNLOADS]: The skill uses
npxto invoke thehyperframesrenderer, which may fetch the tool from the official npm registry if it is not cached locally. - [EXTERNAL_DOWNLOADS]: The animation templates in the
examples/directory reference CSS and font assets from well-known Google Fonts domains (fonts.googleapis.comandfonts.gstatic.com). - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted transcript data and semantic analysis results from the
understanding.jsonfile. While this represents a potential injection surface, the risk is mitigated by the skill's workflow, which requires the user to manually review, edit, and approve all generated copy before it is applied to the project plan.
Audit Metadata