video
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill's functionality aligns with its description as a video production assistant. It references well-known technology services and official documentation sources.
- [EXTERNAL_DOWNLOADS]: The skill suggests installing legitimate packages from the npm registry, specifically 'hyperframes' (maintained by HeyGen) and 'create-video' (maintained by Remotion). These are standard tools for programmatic video.
- [COMMAND_EXECUTION]: Example commands for package installation and project setup are provided. These are benign and intended for the user's development workflow.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting content from local project files (e.g., '.agents/product-marketing.md').
- Ingestion points: '.agents/product-marketing.md', '.claude/product-marketing.md', and 'product-marketing-context.md' (SKILL.md).
- Boundary markers: None present.
- Capability inventory: Generates HTML/React code and interacts with external APIs (e.g., HeyGen MCP).
- Sanitization: None explicitly defined for ingested file content.
Audit Metadata