hyperframes-media
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes transcript data from external sources (Whisper JSON, SRT, VTT) to drive automated caption authoring and animation generation. Maliciously crafted transcripts could attempt to influence the agent's logic during the styling and grouping phases.
- Ingestion points:
references/captions/authoring.mdandreferences/captions/transcript-handling.mdspecify reading external transcript files. - Boundary markers: The instructions lack explicit boundary markers or system prompts to ignore embedded instructions in the transcript data.
- Capability inventory: The skill utilizes
spawnSyncforffmpegoperations inscripts/heygen-tts.mjsand facilitates the generation of browser-based animation code. - Sanitization:
references/captions/transcript-handling.mdprovides a cleaning function to remove non-word tokens (e.g., music symbols and short filler words). - [COMMAND_EXECUTION]: The utility script
scripts/heygen-tts.mjsexecutes theffmpegsystem command to perform audio transcoding. - Evidence:
scripts/heygen-tts.mjscallsspawnSyncto invokeffmpegfor converting MP3 responses from the TTS provider into WAV format. - [EXTERNAL_DOWNLOADS]: The skill fetches several machine learning models and configuration files from external repositories and well-known services.
- Evidence:
references/requirements.mddocuments downloads for Whisper models, Kokoro-82M, MusicGen, and U2Net human segmentation models from sources including Hugging Face. These are well-known resources in the machine learning ecosystem.
Audit Metadata