make-a-video
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several shell commands to manage the video creation lifecycle, including 'mkdir' for project scoping, 'ffmpeg' for frame extraction and visual verification, and 'npx serve' to host a local preview server for the rendered MP4 files. These are core to the skill's utility for media production.
- [REMOTE_CODE_EXECUTION]: The skill leverages 'npx' to execute the 'hyperframes' toolset for initialization, linting, and rendering. It also uses 'npx hyperframes add ' to download and install external sub-compositions (blocks) from the HyperFrames registry into the local project environment.
- [DYNAMIC_EXECUTION]: The skill generates HTML and JavaScript files containing GSAP animation logic. This code is assembled dynamically based on a storyboard synthesized from user-provided scripts, assets, and styling preferences. This runtime generation is the intended mechanism for creating HyperFrames videos.
- [INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect injection as it ingests and processes untrusted user input (scripts, outlines, and asset names) and incorporates them into project files like 'BRIEF.md' and the final compositions.
- Ingestion points: User responses via 'AskUserQuestion', pasted script content, and existing files in the 'assets/' directories.
- Boundary markers: The skill implements hard 'approval gates' where the agent must show the synthesized brief, storyboard, and visual previews to the user and wait for explicit confirmation before proceeding.
- Capability inventory: The skill has capabilities for file system modification, local command execution, and local network hosting.
- Sanitization: The instructions do not specify explicit sanitization for user-provided text before it is written into project files.
Audit Metadata