suede-video

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill includes instructions to install the hyperframes package and execute the create-video scaffold tool using npm and npx. These actions involve fetching and executing code from the external npm registry.\n- [COMMAND_EXECUTION]: Shell commands for tool installation and project scaffolding are provided in the instructions. The skill explicitly requires the agent to seek user authorization before running these commands.\n- [EXTERNAL_DOWNLOADS]: A brand asset logo is fetched from a repository in the author's GitHub organization. The skill includes a SHA-256 integrity hash (83a7ee03...) to verify the file content upon download.\n- [INDIRECT_PROMPT_INJECTION]: The process of reverse-engineering external video edits involves ingesting untrusted data from URLs or media files.\n
  • Ingestion points: External video references analyzed in the references/edit-anatomy.md workflow.\n
  • Boundary markers: The "Originality guardrail" warns the agent to focus only on editing grammar and to avoid copying creative content.\n
  • Capability inventory: The skill can execute rendering commands and prompt AI models for video generation.\n
  • Sanitization: A mandatory human "Review once, then execute" gate is implemented to validate the extracted edit anatomy before any production steps occur.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 04:59 AM