video-editing
Pass
Audited by Gen Agent Trust Hub on Jul 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the execution of several system binaries and scripts to automate video production.
- It utilizes
ffmpegfor complex audio synthesis (e.g., whooshes and clicks) and audio track mixing. - It uses
ffprobeand a local Node.js script (scripts/verify-render.mjs) to perform technical verification of rendered video files (dimensions, codec, and duration). - [EXTERNAL_DOWNLOADS]: The skill relies on the
hyperframesframework, which is downloaded and executed at runtime usingnpx. This is the primary rendering engine for the skill's operations. - [PROMPT_INJECTION]: The skill ingests untrusted data from video scripts and asset manifests, which constitutes an indirect prompt injection attack surface where embedded instructions could potentially influence the agent's output during the composition of the video's HTML source.
- Ingestion points:
script.md(the script beats) andassets/manifest.json(media mapping). - Boundary markers: There are no specific delimiters or system instructions defined to prevent the agent from obeying instructions hidden within the user-provided script.
- Capability inventory: The skill can execute shell commands via
ffmpegandnpx, and has write access to the project directory to generate the video source code. - Sanitization: The skill does not specify any sanitization or escaping protocols for external content before it is interpolated into the HyperFrames project files.
Audit Metadata