helios-core
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill serves as an API guide for the
@helios-project/corelibrary. All documented methods and examples involve standard web development practices for video rendering and animation. There is no evidence of credential exfiltration, malicious command execution, or unauthorized network activity. - [INDIRECT_PROMPT_INJECTION]: The skill includes utilities like
createSystemPromptandinputPropswhich can ingest external data into an agent's context. While this represents a theoretical attack surface for indirect prompt injection, the skill specifically provides aschemavalidation system to enforce data types and constraints, which acts as a security best practice for this use case. The severity is considered low as it is a documented feature of the video engine's integration with AI agents.
Audit Metadata