sprite-video
Warn
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the execution of
npx hyperframes lintandnpx hyperframes validate, which downloads and runs code from thehyperframespackage on the npm registry. - [EXTERNAL_DOWNLOADS]: The generated HTML template fetches the GSAP library from the JSDelivr CDN (
https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js). JSDelivr is a well-known and established content delivery network. - [COMMAND_EXECUTION]: Shell commands are used via
npxto perform linting and validation tasks on the generated animation assets. - [DYNAMIC_EXECUTION]: The skill generates an
index.htmlfile containing JavaScript code that dynamically initializes sprite animators and manages motion timelines at runtime. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: Processes text prompts and user-supplied images to generate visual assets in
SKILL.md. - Boundary markers: None identified; instructions do not specify delimiting or ignoring instructions embedded within the source imagery or descriptive prompts.
- Capability inventory: Execution of shell commands via
npxand browser-based JavaScript execution via the generated HTML files. - Sanitization: No explicit sanitization or validation of the input prompt strings or image metadata is described before they are passed to the image generation tools.
Audit Metadata