faceless-explainer

Pass

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes external commands and manages subprocesses to perform media processing and orchestration tasks.
  • The scripts/assemble-index.mjs script executes ffprobe and ffmpeg to analyze and loop background music files.
  • The scripts/audio.mjs script spawns separate Node.js processes to handle text-to-speech and audio metadata generation.
  • The SKILL.md file instructs the agent to use the hyperframes CLI tool for project initialization, authentication status checks, and final rendering.
  • [DYNAMIC_EXECUTION]: The skill generates and injects executable code at runtime to handle animations and sub-agent coordination.
  • scripts/transitions.mjs dynamically constructs GSAP animation code based on a transition registry and injects it into the project's main index.html file.
  • scripts/captions.mjs generates a self-contained script block containing GSAP animation logic and word timings, which is then injected into the captions.html composition.
  • scripts/frame-packets.mjs assembles instruction packets for sub-agents by dynamically inlining blueprint and animation rule files selected during the storyboard design phase.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes arbitrary user-provided text to generate video content, creating a potential surface for indirect prompt injection.
  • User input is captured and saved verbatim in capture/extracted/visible-text.txt, which serves as the primary information source for the video.
  • The orchestrator parses this text to create a storyboard and script, which are then used to generate prompts for downstream frame-worker sub-agents.
  • The skill implements basic security measures, such as escaping specific characters when injecting data into HTML script tags to mitigate injection risks.
  • [EXTERNAL_DOWNLOADS]: The skill references external resources from well-known services.
  • scripts/assemble-index.mjs and scripts/captions.mjs include the GSAP animation library from the jsDelivr CDN (cdn.jsdelivr.net) within the generated HTML files.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 22, 2026, 11:53 AM