op55-render
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands to run Node.js scripts for audio rendering and Python scripts for video generation.
- [EXTERNAL_DOWNLOADS]: The documentation mentions installing the 'pillow' library via pip, which is a standard and well-known image processing package.
- [DYNAMIC_EXECUTION]: Core functionality involves executing JavaScript score modules and a Python script from a variable path, which constitutes dynamic code execution.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data that could contain malicious instructions.
- Ingestion points: Data is read from 'score.mjs', 'music.meta.json', and user-provided titles.
- Boundary markers: No specific delimitation or 'ignore instructions' markers are defined for the input data.
- Capability inventory: The skill is capable of executing code via Node.js and Python subprocesses.
- Sanitization: No evidence of sanitization or validation for external inputs was found.
Audit Metadata