general-video

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly tells the agent to run npx hyperframes auth status and "relay its output verbatim", which forces the LLM to emit any authentication tokens or sensitive fields present in that command output.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime path delegates scene generation via scripts/frame-packets.mjs which inlines the storyboard block text from the project’s STORYBOARD.md into each frame worker packet, and the frame worker reads that packet content at runtime.