faceless-explainer
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes external commands and manages subprocesses to perform media processing and orchestration tasks.
- The
scripts/assemble-index.mjsscript executesffprobeandffmpegto analyze and loop background music files. - The
scripts/audio.mjsscript spawns separate Node.js processes to handle text-to-speech and audio metadata generation. - The
SKILL.mdfile instructs the agent to use thehyperframesCLI tool for project initialization, authentication status checks, and final rendering. - [DYNAMIC_EXECUTION]: The skill generates and injects executable code at runtime to handle animations and sub-agent coordination.
scripts/transitions.mjsdynamically constructs GSAP animation code based on a transition registry and injects it into the project's mainindex.htmlfile.scripts/captions.mjsgenerates a self-contained script block containing GSAP animation logic and word timings, which is then injected into thecaptions.htmlcomposition.scripts/frame-packets.mjsassembles instruction packets for sub-agents by dynamically inlining blueprint and animation rule files selected during the storyboard design phase.- [INDIRECT_PROMPT_INJECTION]: The skill processes arbitrary user-provided text to generate video content, creating a potential surface for indirect prompt injection.
- User input is captured and saved verbatim in
capture/extracted/visible-text.txt, which serves as the primary information source for the video. - The orchestrator parses this text to create a storyboard and script, which are then used to generate prompts for downstream frame-worker sub-agents.
- The skill implements basic security measures, such as escaping specific characters when injecting data into HTML script tags to mitigate injection risks.
- [EXTERNAL_DOWNLOADS]: The skill references external resources from well-known services.
scripts/assemble-index.mjsandscripts/captions.mjsinclude the GSAP animation library from the jsDelivr CDN (cdn.jsdelivr.net) within the generated HTML files.
Audit Metadata