pr-to-video
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from GitHub Pull Request titles, descriptions, and comments (via
fetch-pr.mjsandingest.mjs). This data is used to generate storyboard plans and narration scripts, creating a surface where malicious text embedded in a PR could theoretically influence the agent's behavior. - Ingestion points: PR metadata and body text ingested into the
visible-text.txtbrief. - Boundary markers: The workflow uses structured formats for storyboards and scripts, providing some separation, though explicit instruction-ignore markers are not used for PR content.
- Capability inventory: The skill can execute shell commands (
gh,npx hyperframes), write files to the project directory, and access GitHub and HeyGen APIs. - Sanitization:
ingest.mjsstrips HTML comments from the PR body;captions.mjsescapes characters in generated HTML/JS for captions. - [EXTERNAL_DOWNLOADS]: The skill fetches contributor avatars from GitHub's official domains (
github.com,*.githubusercontent.com) to be used in the video's credits. Thefetch-people-avatars.mjsscript validates the source URLs and ensures the destination paths remain within the project directory.
Audit Metadata