apple-launch-film

Pass

Audited by Gen Agent Trust Hub on Sep 29, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and install additional skills from third-party sources using npx skills add emilkowalski/skills and npx skills add heygen-com/hyperframes.
  • [COMMAND_EXECUTION]: The skill uses npx commands to install dependencies and perform rendering tasks, specifically npx hyperframes render.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external, potentially untrusted data that could contain malicious instructions.
  • Ingestion points: The skill reads content from brand.md, MOTION.md, and any files located within the ref/ directory to guide its output.
  • Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded prompts within these ingested files.
  • Capability inventory: The agent is empowered to generate and save HTML/JS code and execute shell commands (npx) for environment setup and rendering.
  • Sanitization: There is no mention of sanitizing, validating, or filtering the content of the ingested files before they are used to influence the agent's generation process.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 29, 2026, 01:50 PM