sprite-video

Warn

Audited by Gen Agent Trust Hub on Sep 27, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the execution of npx hyperframes lint and npx hyperframes validate, which downloads and runs code from the hyperframes package on the npm registry.
  • [EXTERNAL_DOWNLOADS]: The generated HTML template fetches the GSAP library from the JSDelivr CDN (https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js). JSDelivr is a well-known and established content delivery network.
  • [COMMAND_EXECUTION]: Shell commands are used via npx to perform linting and validation tasks on the generated animation assets.
  • [DYNAMIC_EXECUTION]: The skill generates an index.html file containing JavaScript code that dynamically initializes sprite animators and manages motion timelines at runtime.
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: Processes text prompts and user-supplied images to generate visual assets in SKILL.md.
  • Boundary markers: None identified; instructions do not specify delimiting or ignoring instructions embedded within the source imagery or descriptive prompts.
  • Capability inventory: Execution of shell commands via npx and browser-based JavaScript execution via the generated HTML files.
  • Sanitization: No explicit sanitization or validation of the input prompt strings or image metadata is described before they are passed to the image generation tools.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 27, 2026, 08:29 AM