skills/varghq/skills/title-design/Gen Agent Trust Hub

title-design

Pass

Audited by Gen Agent Trust Hub on Nov 1, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Downloads and executes the hyperframes rendering tool using npx during the build and render process.
  • Evidence: examples/demo/package.json and examples/demo/README.md reference hyperframes@0.8.206.
  • Source: The tool's registry is configured to point to HeyGen's official GitHub repository in examples/demo/hyperframes.json.
  • [EXTERNAL_DOWNLOADS]: Loads the GSAP (GreenSock Animation Platform) library from the jsDelivr CDN for animation logic in the demo.
  • Evidence: examples/demo/index.html includes a script tag for https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js.
  • [INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided text (names, titles, locations) to populate the video templates, which is a common surface for indirect prompt injection.
  • Ingestion points: User inputs for template parameters like name, role, and text in various JSON and Markdown files.
  • Boundary markers: The skill instructions emphasize using real credentials and provide strict formatting formulas in SKILL.md.
  • Capability inventory: Executes subprocess calls to npx hyperframes to render video files as described in examples/demo/README.md.
  • Sanitization: User-provided text is interpolated into HTML/CSS templates for rendering, with no explicit sanitization scripts present in the provided files.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 1, 2026, 12:01 PM