graphic-overlays

Pass

Audited by Gen Agent Trust Hub on Jun 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes multiple shell commands including ffmpeg, ffprobe, and npx hyperframes to perform media processing, metadata extraction, transcription, and video rendering.
  • [EXTERNAL_DOWNLOADS]: The workflow uses npx to fetch and run the hyperframes package from the npm registry, which is a standard method for executing vendor-provided tooling in this environment.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it ingests and processes transcripts derived from user-provided video files to plan the video storyboard and design graphic overlays.
  • Ingestion points: User-provided audio is transcribed into transcript.json and read by the agent in Step 5 of the workflow.
  • Boundary markers: The skill does not currently use explicit delimiters or "ignore instructions" warnings for the transcript data.
  • Capability inventory: Subprocess execution via ffmpeg and hyperframes, and file writing within the project directory.
  • Sanitization: The skill enforces strict security constraints on generated HTML content, specifically prohibiting <script> tags, external URLs, and inline event handlers, which effectively mitigates the risks of malicious code execution during the rendering process.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 16, 2026, 02:34 AM
Security Audit — agent-trust-hub — graphic-overlays