reddit-launch-video
Pass
Audited by Gen Agent Trust Hub on May 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute system commands including
node,ffmpeg, and thehyperframesCLI. These are used for project initialization, UI screen capture, linting, and final video rendering. - [EXTERNAL_DOWNLOADS]: Utilizes
npx -y hyperframes@latestto download and run the latest version of the HyperFrames tool from the official NPM registry. It also fetches the GSAP animation library from the JSDelivr CDN within the HTML video template. - [REMOTE_CODE_EXECUTION]: The core functionality relies on executing the
hyperframespackage vianpx. This is an intended behavior for using the framework to generate video content from HTML/JS templates. - [DATA_EXFILTRATION]: (Informational) The skill implements a brand identity capture process that reads local project files (such as
tailwind.config.ts,index.css, andbrand-kit.json) and fetches remote website content to extract design tokens like colors and fonts. This data is used locally to style the video and is not exfiltrated to unauthorized third parties.
Audit Metadata