music-to-video
Pass
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The SKILL.md file contains a directive instructing the agent to run an update command ('npx hyperframes skills update music-to-video') 'silently' and 'without asking'. This is a form of autonomy abuse that attempts to bypass the agent's standard behavior of requesting user confirmation for external command execution.
- [EXTERNAL_DOWNLOADS]: The skill performs runtime installation of well-known Python packages (librosa, numpy, soundfile) via pip and executes framework-specific tools using npx. These downloads originate from established package registries (NPM and PyPI).
- [COMMAND_EXECUTION]: Several scripts execute system or local commands as part of the core workflow: The analyze-beatgrid.py script uses subprocess.run to invoke ffmpeg for audio processing. Various Node.js scripts (stage-assets.mjs, assemble-index.mjs, validate-plan.mjs) are used to manage the project environment and validate data. Platform-specific CLI commands (npx hyperframes init, check, and render) are executed to manage the video creation lifecycle.
- [SAFE]: The skill demonstrates security awareness by implementing a 'cleanSvg' function in its templates (e.g., in logo-split-lockup-pulse) which uses an allow-list sanitizer for SVG input to mitigate DOM-XSS risks.
Audit Metadata