apple-launch-film
Warn
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install an external agent skill using
npx skills add emilkowalski/skills --skill apple-design. This source is a personal GitHub repository and not a verified organization. - [EXTERNAL_DOWNLOADS]: The skill fetches the
hyperframestool from the well-known serviceheygen-comusingnpx skills add heygen-com/hyperframes. - [COMMAND_EXECUTION]: The skill executes external commands including
npx hyperframes renderand references areel-exportcommand for video processing. - [INDIRECT_PROMPT_INJECTION]: The skill builds instructions for the agent by interpolating untrusted user-supplied data such as
[PRODUCT],[FACTS LIST], and[SCENES]. Ingestion points: User inputs for product details and feature lists. Boundary markers: The skill uses bracketed placeholders but lacks explicit instructions to ignore potentially malicious content within these variables. Capability inventory: The skill is designed to generate HTML/JS files and execute rendering commands. Sanitization: No sanitization or validation of the input data is performed before it is included in the agent brief.
Audit Metadata