create-anime-lifehack

Pass

Audited by Gen Agent Trust Hub on Sep 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill relies on shell command execution for its core workflow, including environment checks (which ffmpeg), dependency management (npm install), and media processing via a custom bash script (combine-scenes.sh) that invokes ffmpeg and ffprobe. It also uses npx tsx to execute its internal TypeScript logic.
  • [EXTERNAL_DOWNLOADS]: The skill performs network operations to download generated image and video assets from fal.ai (a well-known AI service provider) and installs Node.js dependencies from the official npm registry. The scripts/fal.ts file contains a dedicated downloadFile utility using the standard Node.js https module.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided "topics" which are then interpolated into AI generation prompts and used for directory naming.
  • Ingestion points: User input in SKILL.md Step 1.
  • Boundary markers: None explicitly defined to prevent instructions inside the topic from affecting the agent.
  • Capability inventory: The skill can execute shell commands, perform network requests, and write files to the local disk.
  • Sanitization: A sanitize function in scripts/fal.ts proactively filters filenames by removing shell metacharacters and directory traversal patterns (e.g., <>:"/\\|?*).
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 29, 2026, 06:40 AM