short-drama-edit
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill integrates with
ffmpegandffprobefor video/audio processing, metadata extraction, and media verification. These operations are conducted throughsubprocess.runusing secure list-based arguments, which mitigates shell injection risks. - [EXTERNAL_DOWNLOADS]: To support advanced subtitle rendering and visual overlays, the skill utilizes the
Remotionframework. This requires the installation of standard Node.js packages (e.g.,react,remotion,@fontsource/*) from the official npm registry. These are well-known, industry-standard dependencies. - [INDIRECT_PROMPT_INJECTION]: The skill parses project files like
剪辑单.md(cut list) and剧本.md(screenplay) to derive timestamps, text for subtitles, and scene metadata. - Ingestion points: Data is ingested from local markdown files within the project structure.
- Boundary markers: The parser relies on specific markdown heading patterns (e.g.,
## CUT-...) and field prefixes to isolate data. - Capability inventory: Parsed information is used solely to parameterize media processing tools; it is not executed as code or interpreted as agent instructions.
- Sanitization: The skill employs strict regular expression matching and data validation (e.g., verifying timestamp ranges and ensuring source IDs exist in prompts) before processing.
- [DYNAMIC_EXECUTION]: At runtime, the skill generates a structured JSON file (
叠层.props.json) containing properties for the visual overlay. This file is consumed by a localRemotionprocess to render frames. This mechanism represents a controlled data exchange between the Python orchestration script and the Node.js rendering engine.
Audit Metadata