music-to-video
Warn
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill orchestrates video project initialization and rendering through multiple shell commands and CLI tool invocations.
- Evidence:
SKILL.mdincludes commands fornpx hyperframes init,npx hyperframes render, and execution of local node scripts likestage-assets.mjs. - [COMMAND_EXECUTION]: The audio analysis script uses a subprocess to invoke ffmpeg for audio transcoding and processing.
- Evidence:
scripts/analyze-beatgrid.pyexecutessubprocess.run(["ffmpeg", ...])to convert audio to mono float32 wav files. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of several Python packages at runtime to support its audio analysis functionality.
- Evidence:
SKILL.mdinstructs the user to runpython3 -m pip install librosa numpy soundfile. - [EXTERNAL_DOWNLOADS]: Resources such as JavaScript libraries and fonts are loaded from public CDNs in generated index files and templates.
- Evidence:
scripts/assemble-index.mjsloads GSAP fromcdn.jsdelivr.net, andreferences/templates/held-message-living-field/index.htmlloads Three.js and Google Fonts. - [EXTERNAL_DOWNLOADS]: A vendored version of the GSAP library within the skill contains deceptive metadata, including a non-existent version number and a future copyright date, which could indicate unofficial modifications.
- Evidence:
references/motion-primitives/assets/gsap.min.jscontains a header claimingGSAP 3.15.0andCopyright 2026, whereas the current official version is 3.12.x.
Audit Metadata