hyperframes-website-to-video
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill frequently executes
npx hyperframescommands to perform tasks such as website capture, video rendering, transcription, and project validation. These commands are localized to the project environment and are necessary for the skill's primary functionality. - [EXTERNAL_DOWNLOADS]: The skill includes instructions to update itself and its core dependencies from the author's GitHub repository (
https://github.com/TheAngryPit/TheAngrySkills.git). This is a documented self-update mechanism used by the vendor to ensure all hyperframes components are synchronized. - [CREDENTIALS_UNSAFE]: The workflow manages API keys for HeyGen, ElevenLabs, and Google Gemini. It correctly instructs the user to store these in
.envfiles to prevent accidental exposure and provides clear guidance on cost and setup. - [INDIRECT_PROMPT_INJECTION]: The skill processes content from arbitrary external URLs provided by the user. This constitutes an indirect prompt injection surface. The risk is mitigated by using structured sub-agent prompts with clear boundary markers (e.g.,
═══ THIS BEAT ═══) and mandatory human approval gates for the storyboard and final output. - [DYNAMIC_CODE_EXECUTION]: The skill generates HTML and JavaScript files (
compositions/*.html) to build video frames. Security is maintained through a specialized linter (npx hyperframes lint) and a validation script (w2h-verify.mjs) that check for non-deterministic or unsafe code patterns before rendering.
Audit Metadata