listenhub-hypit
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses local command-line tools to process media and orchestrate video builds. Specifically, it executes ffmpeg for video manipulation, npx hypit for project orchestration and rendering, and the listenhub CLI for interacting with AI generation services. These operations are consistent with the skill's stated purpose of local video production.
- [EXTERNAL_DOWNLOADS]: The skill instructs the installation of necessary tools and dependencies. It downloads the @hypit/hypit framework from NPM and refers to the hypit-ai GitHub organization for skill extensions. These downloads are part of the standard setup process for the Hypit ecosystem and originate from identified services.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data, including reference videos and text briefs, to generate video orchestration scripts. Ingestion points: User-provided media and briefs (production.md). Boundary markers: Structured XML (.svml) and build manifests (.svrun). Capability inventory: Shell execution (ffmpeg, npx), file writes, and network requests to vendor APIs. Sanitization: Framework-level checks (npx hypit check and npx hypit plan) are used to verify project integrity before rendering.
Audit Metadata