tiktok-launch-video
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and executes the
hyperframespackage from the NPM registry usingnpx -y hyperframes@latestduring the initialization step. - [COMMAND_EXECUTION]: The skill uses shell commands to verify the environment (Node.js and FFmpeg versions) and to interact with the
hyperframesCLI for project setup, linting, and video rendering. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external websites via
WebFetchand local marketing context files. This information is used to generate video scripts and HTML templates, creating an attack surface for instructions embedded in external content. - Ingestion points: Step 1c uses
WebFetchfor URLs, and Step 1a reads local marketing context files. - Boundary markers: No specific delimiters or "ignore embedded instructions" markers are defined for the fetched external content.
- Capability inventory: The skill utilizes
Bashfor rendering andWritefor project file generation. - Sanitization: There is no evidence of explicit sanitization or escaping of the fetched product descriptions before they are interpolated into the beat sheet or HTML templates.
- [DYNAMIC_EXECUTION]: The skill dynamically generates an
index.htmlcomposition and abrand-kit.jsonfile at runtime based on the gathered context, which are then processed by thehyperframesengine to create the video.
Audit Metadata