hyperframes-codex-video

Pass

Audited by Gen Agent Trust Hub on Oct 30, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill installs the Hyperframes framework and related skills using npx hyperframes doctor and npx skills add heygen-com/hyperframes. These resources are provided by the Hyperframes organization and associated with the well-known AI video service HeyGen.
  • [COMMAND_EXECUTION]: The skill requires the execution of shell commands for environment setup and video rendering, specifically utilizing npx and FFmpeg locally.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, including video transcripts from local directories and brand assets (logos) from external storage like Google Drive. This data influences the agent's behavior during scene planning and motion graphics generation.
  • Ingestion points: Local transcript files in YT_DIR and project assets from external drives.
  • Boundary markers: Absent; there are no explicit delimiters or instructions for the agent to ignore potentially malicious commands embedded within the transcript text.
  • Capability inventory: The skill can execute shell commands (npx, ffmpeg), write files to the local system, and generate executable web code (HTML/JS).
  • Sanitization: Absent; the instructions do not define methods for sanitizing or validating the content of transcripts before they are processed by the agent.
  • [DYNAMIC_EXECUTION]: The agent dynamically generates and executes HTML, CSS, and JavaScript code using libraries such as GSAP and Three.js to create motion graphics, which is the primary functional mechanism of the skill.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 30, 2026, 07:02 AM