html-anime-direct

Pass

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses shell commands to process and validate files. It runs harness/compile.js to generate shot sheets and executes npx hyperframes lint and npx hyperframes validate to verify the generated HTML film directory.
  • [EXTERNAL_DOWNLOADS]: The skill utilizes npx to run the hyperframes utility, which triggers a download from the public npm registry if the package is not already cached in the environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input (loglines or pasted shot sheets) to generate logic and content for HTML files, presenting a potential injection surface.
  • Ingestion points: User-provided loglines or manually pasted html-anime sheets in SKILL.md.
  • Boundary markers: None present; user input is directly used to define the film's 'verb', 'slug', and dialogue.
  • Capability inventory: Writing files to the filesystem (films/<slug>/index.html), executing a local JavaScript compiler (harness/compile.js), and running CLI validation tools via npx.
  • Sanitization: No sanitization, escaping, or validation of the user-provided logline is mentioned before it is used to generate the film sheet or index.html file.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 22, 2026, 06:22 PM