short-drama-edit

Pass

Audited by Gen Agent Trust Hub on Nov 2, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill integrates with ffmpeg and ffprobe for video/audio processing, metadata extraction, and media verification. These operations are conducted through subprocess.run using secure list-based arguments, which mitigates shell injection risks.
  • [EXTERNAL_DOWNLOADS]: To support advanced subtitle rendering and visual overlays, the skill utilizes the Remotion framework. This requires the installation of standard Node.js packages (e.g., react, remotion, @fontsource/*) from the official npm registry. These are well-known, industry-standard dependencies.
  • [INDIRECT_PROMPT_INJECTION]: The skill parses project files like 剪辑单.md (cut list) and 剧本.md (screenplay) to derive timestamps, text for subtitles, and scene metadata.
  • Ingestion points: Data is ingested from local markdown files within the project structure.
  • Boundary markers: The parser relies on specific markdown heading patterns (e.g., ## CUT-...) and field prefixes to isolate data.
  • Capability inventory: Parsed information is used solely to parameterize media processing tools; it is not executed as code or interpreted as agent instructions.
  • Sanitization: The skill employs strict regular expression matching and data validation (e.g., verifying timestamp ranges and ensuring source IDs exist in prompts) before processing.
  • [DYNAMIC_EXECUTION]: At runtime, the skill generates a structured JSON file (叠层.props.json) containing properties for the visual overlay. This file is consumed by a local Remotion process to render frames. This mechanism represents a controlled data exchange between the Python orchestration script and the Node.js rendering engine.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 2, 2026, 07:05 AM