product-launch-video
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from user-provided marketing URLs, scripts, and briefs to generate project plans and video content. * Ingestion points: Data enters through the 'Setup' and 'Capture' steps in SKILL.md, where external URL content is crawled and user scripts are saved. * Boundary markers: The skill establishes a BRIEF.md and STORYBOARD.md to define project constraints and separate instructions from raw data. * Capability inventory: The workflow utilizes web capture tools, subprocess execution for media processing (ffmpeg), and local script execution for index assembly and transition injection. * Sanitization: The instructions highlight the use of SVG sanitization in specific asset export paths and validate the structure of storyboard and script files.
- [EXTERNAL_DOWNLOADS]: The skill uses the npx command to run and update hyperframes CLI tools and manages dependencies for video rendering. * Evidence: npx hyperframes skills update product-launch-video and npx hyperframes init are used for environment setup and maintenance.
- [DYNAMIC_EXECUTION]: The skill dynamically generates index.html and frame compositions using Node.js scripts that process project metadata. * Evidence: scripts/assemble-index.mjs and scripts/frame-packets.mjs assemble HTML and script content based on the project's storyboard.
Audit Metadata