graphic-overlays
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple shell commands including
ffmpeg,ffprobe, andnpx hyperframesto perform media processing, metadata extraction, transcription, and video rendering. - [EXTERNAL_DOWNLOADS]: The workflow uses
npxto fetch and run thehyperframespackage from the npm registry, which is a standard method for executing vendor-provided tooling in this environment. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it ingests and processes transcripts derived from user-provided video files to plan the video storyboard and design graphic overlays.
- Ingestion points: User-provided audio is transcribed into
transcript.jsonand read by the agent in Step 5 of the workflow. - Boundary markers: The skill does not currently use explicit delimiters or "ignore instructions" warnings for the transcript data.
- Capability inventory: Subprocess execution via
ffmpegandhyperframes, and file writing within the project directory. - Sanitization: The skill enforces strict security constraints on generated HTML content, specifically prohibiting
<script>tags, external URLs, and inline event handlers, which effectively mitigates the risks of malicious code execution during the rendering process.
Audit Metadata