html-anime-direct
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands to process and validate files. It runs
harness/compile.jsto generate shot sheets and executesnpx hyperframes lintandnpx hyperframes validateto verify the generated HTML film directory. - [EXTERNAL_DOWNLOADS]: The skill utilizes
npxto run thehyperframesutility, which triggers a download from the public npm registry if the package is not already cached in the environment. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input (loglines or pasted shot sheets) to generate logic and content for HTML files, presenting a potential injection surface.
- Ingestion points: User-provided loglines or manually pasted html-anime sheets in SKILL.md.
- Boundary markers: None present; user input is directly used to define the film's 'verb', 'slug', and dialogue.
- Capability inventory: Writing files to the filesystem (
films/<slug>/index.html), executing a local JavaScript compiler (harness/compile.js), and running CLI validation tools vianpx. - Sanitization: No sanitization, escaping, or validation of the user-provided logline is mentioned before it is used to generate the film sheet or index.html file.
Audit Metadata