creativeclaw-render-html-video
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill generates HTML and JavaScript based on user input which is subsequently processed by the
render_html_videotool.\n - Ingestion points: User-provided text, media URLs, and animation requirements described in
SKILL.md.\n - Boundary markers: The instructions do not specify boundary markers or explicit warnings for the HTML construction.\n
- Capability inventory: The
render_html_videotool (SKILL.md) and thecreative-clawMCP tool (agents/openai.yaml) allow for remote job submission and media processing.\n - Sanitization: No explicit sanitization or validation of the generated HTML/JS is described before it is sent to the renderer.\n- [DYNAMIC_EXECUTION]: The skill's primary function is generating and executing dynamic JavaScript/HTML content (GSAP timelines) as part of its core video production workflow.\n- [EXTERNAL_DOWNLOADS]: The skill references external resources from well-known and vendor-owned services.\n
- The HTML composition example in
SKILL.mdloads the GSAP library fromcdn.jsdelivr.net.\n - The agent configuration in
agents/openai.yamlconnects to the vendor's MCP service atapp.creativeclaw.co.\n- [COMMAND_EXECUTION]: The skill invokes therender_html_videotool to submit asynchronous rendering jobs to the HyperFrames backend.
Audit Metadata