video-editing

Pass

Audited by Gen Agent Trust Hub on Jul 4, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill facilitates the execution of several system binaries and scripts to automate video production.
  • It utilizes ffmpeg for complex audio synthesis (e.g., whooshes and clicks) and audio track mixing.
  • It uses ffprobe and a local Node.js script (scripts/verify-render.mjs) to perform technical verification of rendered video files (dimensions, codec, and duration).
  • [EXTERNAL_DOWNLOADS]: The skill relies on the hyperframes framework, which is downloaded and executed at runtime using npx. This is the primary rendering engine for the skill's operations.
  • [PROMPT_INJECTION]: The skill ingests untrusted data from video scripts and asset manifests, which constitutes an indirect prompt injection attack surface where embedded instructions could potentially influence the agent's output during the composition of the video's HTML source.
  • Ingestion points: script.md (the script beats) and assets/manifest.json (media mapping).
  • Boundary markers: There are no specific delimiters or system instructions defined to prevent the agent from obeying instructions hidden within the user-provided script.
  • Capability inventory: The skill can execute shell commands via ffmpeg and npx, and has write access to the project directory to generate the video source code.
  • Sanitization: The skill does not specify any sanitization or escaping protocols for external content before it is interpolated into the HyperFrames project files.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 4, 2026, 08:45 PM