hyperframes-product-launch-video
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands via
npxandnodeto manage project lifecycle tasks, including initialization, asset capture, and video assembly. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external URLs via a capture tool. To mitigate injection risks,
scripts/assemble-index.mjsuses a strict whitelist to sanitize HTML attributes during the assembly of video elements, explicitly excluding unsafe attributes likeonerrororsrcdoc. - [DYNAMIC_EXECUTION]: The skill generates complex HTML and JavaScript (GSAP) compositions at runtime to create video frames. This dynamic generation is restricted to the specific requirements of the video rendering engine.
- [EXTERNAL_DOWNLOADS]: The skill utilizes
npxto check for updates and manage specialized sub-skills, which is a standard behavior for the HyperFrames platform.
Audit Metadata