suede-video
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill includes instructions to install the
hyperframespackage and execute thecreate-videoscaffold tool usingnpmandnpx. These actions involve fetching and executing code from the external npm registry.\n- [COMMAND_EXECUTION]: Shell commands for tool installation and project scaffolding are provided in the instructions. The skill explicitly requires the agent to seek user authorization before running these commands.\n- [EXTERNAL_DOWNLOADS]: A brand asset logo is fetched from a repository in the author's GitHub organization. The skill includes a SHA-256 integrity hash (83a7ee03...) to verify the file content upon download.\n- [INDIRECT_PROMPT_INJECTION]: The process of reverse-engineering external video edits involves ingesting untrusted data from URLs or media files.\n - Ingestion points: External video references analyzed in the
references/edit-anatomy.mdworkflow.\n - Boundary markers: The "Originality guardrail" warns the agent to focus only on editing grammar and to avoid copying creative content.\n
- Capability inventory: The skill can execute rendering commands and prompt AI models for video generation.\n
- Sanitization: A mandatory human "Review once, then execute" gate is implemented to validate the extracted edit anatomy before any production steps occur.
Audit Metadata