website-to-video
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from user-provided external URLs via the
hyperframes capturecommand. This data—including extracted text, assets, and design tokens—is subsequently used to influence the generation of video storyboards, narration scripts, and visual compositions. The combination of external content ingestion with high-capability tools (file system writes, network API access, and local script execution) represents a surface for potential indirect prompt injection attacks. - [DYNAMIC_EXECUTION]: The workflow involves the dynamic generation and writing of multiple HTML and JavaScript files (
index.htmland variouscompositions/*.html) derived from site analysis and creative templates. These generated files are then rendered using thehyperframesengine. While the skill employs specific verification gates and linting to ensure quality and safety, the runtime assembly and execution of code based on external inputs is a characteristic that requires monitoring.
Audit Metadata