guided-explainer-video
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs several Node.js packages from the
@helios-projectnamespace (@helios-project/core,@helios-project/renderer,@helios-project/cli) to facilitate video rendering and composition. - [COMMAND_EXECUTION]: The skill utilizes the
npx helios rendercommand to process the generated HTML composition into a final MP4 video file. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data by researching brand identity from either a user-provided URL or local codebase files such as documentation and CSS stylesheets.
- Ingestion points: External marketing sites/URLs and local project assets (Tailwind configs, stylesheets, microcopy).
- Boundary markers: There are no explicit instructions or delimiters used to isolate researched content from the agent's core instructions.
- Capability inventory: The skill has the capability to install packages, write local HTML/JS files, and execute CLI tools.
- Sanitization: The skill does not define specific sanitization routines for the data extracted during the brand research phase.
- [CREDENTIALS_UNSAFE]: While the skill mentions the requirement of an
ELEVEN_LABS_API_KEY, it follows security best practices by explicitly instructing the agent NOT to read.envfiles or verify keys itself, instead directing the user to manage the key in their environment.
Audit Metadata