make-a-video

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes several local commands to manage the video production lifecycle. These include npx hyperframes for project initialization, linting, rendering, and TTS/transcription; ffmpeg for extracting frames for visual verification; and npx serve for hosting a local preview server.
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates the processing of untrusted user data into a code execution context.
  • Ingestion points: User input is gathered through eight gates, including the full video script, aspect ratios, asset paths, and CSS style preferences (Gate 1 through Gate 3).
  • Boundary markers: None are defined. The skill synthesizes user input directly into BRIEF.md, STORYBOARD.md, and the final HTML/JS compositions without using delimiters to separate instructions from data.
  • Capability inventory: The skill has the ability to write multiple files to the workspace, execute shell commands via the framework CLI, and launch local web servers.
  • Sanitization: There is no evidence of sanitization or escaping for user-supplied strings before they are interpolated into the GSAP/HTML boilerplate in Gate 6.
  • [EXTERNAL_DOWNLOADS]: The skill downloads resources from external sources. It fetches typography from Google Fonts and installs functional video blocks via npx hyperframes add.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 09:06 PM