guided-explainer-video

Pass

Audited by Gen Agent Trust Hub on Sep 28, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill installs several Node.js packages from the @helios-project namespace (@helios-project/core, @helios-project/renderer, @helios-project/cli) to facilitate video rendering and composition.
  • [COMMAND_EXECUTION]: The skill utilizes the npx helios render command to process the generated HTML composition into a final MP4 video file.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data by researching brand identity from either a user-provided URL or local codebase files such as documentation and CSS stylesheets.
  • Ingestion points: External marketing sites/URLs and local project assets (Tailwind configs, stylesheets, microcopy).
  • Boundary markers: There are no explicit instructions or delimiters used to isolate researched content from the agent's core instructions.
  • Capability inventory: The skill has the capability to install packages, write local HTML/JS files, and execute CLI tools.
  • Sanitization: The skill does not define specific sanitization routines for the data extracted during the brand research phase.
  • [CREDENTIALS_UNSAFE]: While the skill mentions the requirement of an ELEVEN_LABS_API_KEY, it follows security best practices by explicitly instructing the agent NOT to read .env files or verify keys itself, instead directing the user to manage the key in their environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 28, 2026, 12:41 AM