short-form-video
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on system utilities ffmpeg and ffprobe to perform media analysis and video rendering tasks.- [EXTERNAL_DOWNLOADS]: The skill instructs the use of npx hyperframes to run framework-specific commands, which involves fetching and executing code from the npm registry.- [INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface by ingesting external data from transcript.json to generate karaoke captions and synchronize scenes.
- Ingestion points: assets/transcript.json (Whisper/ElevenLabs output).
- Boundary markers: Absent; there are no instructions to delimit or ignore potential prompt injections within the transcript text.
- Capability inventory: Full access to shell execution via ffmpeg, ffprobe, and the hyperframes CLI.
- Sanitization: Absent; the content is interpolated directly into the composition scaffold without filtering.
Audit Metadata