promo-editor
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches styling resources from Google Fonts and the GSAP animation library from the JSDelivr CDN. These are well-known and trusted services used for the skill's core video composition functionality.
- [COMMAND_EXECUTION]: The skill executes shell commands including
ffmpegandnpx hyperframes render. These are standard tools for video processing and are used here for the intended purpose of rendering HTML content into video files. - [REMOTE_CODE_EXECUTION]: Utilizes
npxto execute thehyperframespackage from the npm registry. While this involves downloading and running code, the npm registry is a well-known service and the package is the central rendering engine required for the skill to function. - [PROMPT_INJECTION]: The skill ingests data from external files like
02-storyboard.mdand03-asset-plan.mdto guide the video creation process. This represents a standard surface for processing user-provided content in a video editing workflow and does not contain malicious override patterns.
Audit Metadata