talking-head-hyperframes
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements comprehensive integrity verification, requiring SHA-256 hashes for all project manifest files and archived media inputs to detect and prevent data tampering.
- [SAFE]: A security-conscious executable resolution pattern is used in
project-integrity.mjs, which explicitly excludes the project's own directory when searching for system tools like FFmpeg or NPM, mitigating potential binary hijacking attacks. - [SAFE]: Dynamic dependency installation performed by the
package-loader.mjsscript is restricted to a hardcoded allowlist of well-known packages, utilizes strict version pinning, and disables lifecycle scripts to prevent execution of malicious post-install hooks. - [SAFE]: Project scaffolding logic includes atomic commit and recovery mechanisms to ensure that the project filesystem remains in a consistent state even if a process is interrupted.
Audit Metadata