helios-getting-started
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install packages from the
@helios-projectnamespace (core, renderer, player, cli) using npm. It also notes that the renderer package bundles FFmpeg via@ffmpeg-installer/ffmpegand that the first run may download a headless Chromium browser via Playwright. - [INDIRECT_PROMPT_INJECTION]: The skill describes a workflow where a renderer process ingests an HTML composition file to produce video output. This involves executing JavaScript within a headless browser context, which is the intended primary purpose of the programmatic video engine.
Audit Metadata