video
Warn
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill instructs the agent to generate and execute code for video production purposes. It recommends creating HTML, CSS, and JavaScript frames for the Hyperframes framework and React components for Remotion, which are then rendered into MP4 files. This involves the dynamic assembly and execution of scripts.
- [INDIRECT_PROMPT_INJECTION]: The 'Reverse-Engineering' workflow involves processing data from external video sources retrieved via tools like
watch-videoorsocial-fetch. This untrusted content could contain instructions intended to manipulate the agent's output or actions. - Ingestion points: Untrusted data enters the context through analysis of videos fetched from external platforms (SKILL.md, references/edit-anatomy.md).
- Boundary markers: The skill includes a 'review-once gate' that requires human approval of a 'beat sheet' before the agent proceeds with video production.
- Capability inventory: The agent has the ability to execute shell commands for package installation and call rendering functions that process generated code.
- Sanitization: No automated sanitization or filtering of the extracted video metadata or transcriptions is specified.
- [EXTERNAL_DOWNLOADS]: The skill refers to downloading and installing external software packages such as
hyperframesandcreate-videofrom public repositories. It also lists several AI video platforms and documentation sites. - [COMMAND_EXECUTION]: The skill provides instructions for executing shell commands to install dependencies, including
npm install hyperframesandnpx create-video@latest.
Audit Metadata