general-video

Pass

Audited by Gen Agent Trust Hub on Oct 15, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes project-level artifacts such as STORYBOARD.md and BRIEF.md which contain user-provided content. This content is interpolated into instruction packets for sub-agents (frame workers), creating an attack surface where malicious instructions in the storyboard could influence sub-agent behavior.
  • Ingestion points: STORYBOARD.md, BRIEF.md, and design truth files (frame.md, design.md, DESIGN.md) read by scripts/frame-packets.mjs and processed in SKILL.md.
  • Boundary markers: The skill uses markdown headers (## Frame packet, ## Project inputs) and delimited blocks to separate inputs, and explicitly instructs sub-agents to "read the two as one role."
  • Capability inventory: File system read/write (via node:fs), shell command execution (npx hyperframes), and sub-agent dispatching.
  • Sanitization: The frame-packets-core.mjs script uses regex parsing and escapeRegExp for rule identification, but relies on structured markdown for general content boundary management.
  • [DYNAMIC_EXECUTION]: The skill dynamically constructs role definitions (_role.md) and task packets for sub-agents at runtime by concatenating pre-defined markdown templates with content extracted from the project's storyboard. This occurs in scripts/lib/frame-packets-core.mjs during the dispatch phase.
  • [COMMAND_EXECUTION]: The skill executes multiple shell commands using npx and node to manage the video production lifecycle, including npx hyperframes lint, npx hyperframes check, and npx hyperframes auth status. These commands interact with the local environment and the vendor's authentication services.
  • [EXTERNAL_DOWNLOADS]: The skill fetches updates and searches a hosted component registry using npx hyperframes skills update and npx hyperframes catalog. These operations target the vendor's official package registry and services.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 15, 2026, 03:54 AM