hyperframes
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process data from external, potentially untrusted sources to generate video compositions.
- Ingestion points: The skill specifies that workflows ingest content from product URLs, general websites, and GitHub Pull Request links (documented in SKILL.md).
- Boundary markers: No explicit delimiters or instructions to ignore embedded commands within the processed data are defined in this entry skill.
- Capability inventory: The skill uses the gh CLI for reading repository data, headless Chrome for web scraping, and npx for project initialization and component management.
- Sanitization: No specific sanitization or filtering logic for external input is mentioned in the routing instructions.
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to use various CLI tools to perform its tasks.
- Evidence: It directs the agent to use the gh CLI to retrieve Pull Request details and npx to install skills and initialize the project environment (e.g., npx skills add, npx hyperframes init).
- [EXTERNAL_DOWNLOADS]: The skill is configured to fetch its modular components and updates from a remote repository.
- Evidence: It utilizes npx to download and synchronize workflow skills directly from the official HyperFrames GitHub repository (heygen-com/hyperframes).
Audit Metadata