hyperframes-music-to-video
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The Python script
analyze-beatgrid.pyexecutes theffmpegutility viasubprocess.runto convert input audio files into a standard format for analysis. This is a functional requirement and uses safe argument passing to prevent shell injection. - [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data such as user-provided briefs, lyric text, and audio transcriptions which are then interpolated into animation templates.
- Ingestion points: User-provided lyrics, audio transcriptions, and project briefs.
- Boundary markers: Instructions use a structured storyboard format to separate planning data from creative content.
- Capability inventory: The skill performs file writing (
writeFileSync) and executes audio processing tools. - Sanitization: The
logo-split-lockup-pulsetemplate implements a robustcleanSvgfunction that sanitizes SVG input using a whitelist of safe tags and attributes, effectively mitigating DOM-XSS risks. - [EXTERNAL_DOWNLOADS]: The generated video files load the GSAP and Three.js libraries from a well-known CDN (jsDelivr).
Audit Metadata