make-a-video
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several local commands to manage the video production lifecycle. These include
npx hyperframesfor project initialization, linting, rendering, and TTS/transcription;ffmpegfor extracting frames for visual verification; andnpx servefor hosting a local preview server. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the processing of untrusted user data into a code execution context.
- Ingestion points: User input is gathered through eight gates, including the full video script, aspect ratios, asset paths, and CSS style preferences (Gate 1 through Gate 3).
- Boundary markers: None are defined. The skill synthesizes user input directly into
BRIEF.md,STORYBOARD.md, and the final HTML/JS compositions without using delimiters to separate instructions from data. - Capability inventory: The skill has the ability to write multiple files to the workspace, execute shell commands via the framework CLI, and launch local web servers.
- Sanitization: There is no evidence of sanitization or escaping for user-supplied strings before they are interpolated into the GSAP/HTML boilerplate in Gate 6.
- [EXTERNAL_DOWNLOADS]: The skill downloads resources from external sources. It fetches typography from Google Fonts and installs functional video blocks via
npx hyperframes add.
Audit Metadata