video-hyperframes
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill has a surface for indirect prompt injection due to how user data is handled. Ingestion points: The template in SKILL.md takes 'User Content' to generate the body of the frames. Boundary markers: None are defined to separate user data from the HTML structure. Capability inventory: The skill generates HTML and JavaScript code meant for rendering in a browser or previewer. Sanitization: No instructions are provided to the agent to sanitize or escape user input before interpolation.
- [EXTERNAL_DOWNLOADS]: The skill's example references styling and font assets from well-known services. It downloads the Tailwind CSS library from https://cdn.tailwindcss.com and retrieves typography from Google Fonts (fonts.googleapis.com).
- [REMOTE_CODE_EXECUTION]: The skill generates dynamic JavaScript code at runtime. SKILL.md instructs the agent to create a JavaScript block at the top of the output to facilitate frame transitions and UI controls. The resulting script uses standard browser APIs (setTimeout, requestAnimationFrame) to implement autoplay and progress tracking.
Audit Metadata