promo-editor

Pass

Audited by Gen Agent Trust Hub on Jul 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches styling resources from Google Fonts and the GSAP animation library from the JSDelivr CDN. These are well-known and trusted services used for the skill's core video composition functionality.
  • [COMMAND_EXECUTION]: The skill executes shell commands including ffmpeg and npx hyperframes render. These are standard tools for video processing and are used here for the intended purpose of rendering HTML content into video files.
  • [REMOTE_CODE_EXECUTION]: Utilizes npx to execute the hyperframes package from the npm registry. While this involves downloading and running code, the npm registry is a well-known service and the package is the central rendering engine required for the skill to function.
  • [PROMPT_INJECTION]: The skill ingests data from external files like 02-storyboard.md and 03-asset-plan.md to guide the video creation process. This represents a standard surface for processing user-provided content in a video editing workflow and does not contain malicious override patterns.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 9, 2026, 06:56 AM
Security Audit — agent-trust-hub — promo-editor