general-video

Pass

Audited by Gen Agent Trust Hub on Sep 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes the hyperframes CLI via npx for project initialization, authentication, and status checks. It also executes local Node.js scripts for managing project preferences and applying recipes.
  • [EXTERNAL_DOWNLOADS]: Fetches visual treatments and components from a hosted registry using npx hyperframes catalog. It also integrates with Figma to import design assets and tokens from external URLs.
  • [DYNAMIC_EXECUTION]: Employs a 'dispatch' pattern that generates instruction packets and worker roles to process scenes in parallel, allowing the agent to delegate sub-tasks within a controlled environment through generated instruction files.
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: Processes user-provided BRIEF.md and STORYBOARD.md files, alongside external data from Figma URLs, to define the project scope and content.
  • Boundary markers: Utilizes a strict markdown format for storyboards and briefs to separate project metadata from content instructions, including the use of canonical terms defined in referenced contracts.
  • Capability inventory: The agent uses file-system operations and shell command execution (npx, node) to manage the video production pipeline.
  • Sanitization: The instructions explicitly require the use of specialized adapters for Figma assets to ensure proper sanitization of SVG content and verification of media provenance.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 24, 2026, 03:40 AM
Security Audit — agent-trust-hub — general-video