day-in-my-life
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the Gochi Hand font from Google Fonts during preview and render stages.- [REMOTE_CODE_EXECUTION]: Executes the HyperFrames CLI (version 0.8.70) via npx to perform rendering and project validation.- [COMMAND_EXECUTION]: Spawns subprocesses to run ffmpeg for audio mastering, loudness normalization, and quality control checks on the generated MP4 file.- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from local chat transcripts (~/.claude/projects). This risk is mitigated by an evidence-based Privacy Gate (in references/story.md) requiring explicit user approval of all lines, along with regex-based validation in harvest.py and new-film.mjs that blocks secrets, emails, and system paths.- [DYNAMIC_EXECUTION]: Uses Puppeteer to launch a headless browser for capturing stills and generates a story.js configuration file at runtime based on processed history data.
Audit Metadata