vid-sizzle-reel
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the HyperFrames rendering engine and the GSAP animation library from official vendor sources and well-known public CDNs during project initialization and rendering.
- [COMMAND_EXECUTION]: Shell commands are executed to initialize the project structure, analyze audio for beat-syncing, and render the final MP4 video. These operations utilize standard tools like Node.js, npx, and FFmpeg.
- [DYNAMIC_EXECUTION]: At runtime, the skill generates a dynamic HTML and JavaScript composition. This source code is executed in a headless browser environment to produce the frames required for video assembly.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text and asset paths to create the visual content of the video.
- Ingestion points: User-supplied 'key_messages' and 'brand_assets' are incorporated into the HTML source code in the SKILL.md Step 4.
- Boundary markers: The instructions define specific CSS classes ('clip') and GSAP timeline structures to manage the layout and timing of injected content.
- Capability inventory: The skill possesses file-writing capabilities and shell execution privileges through 'npx hyperframes render' to convert the generated HTML into a video file.
- Sanitization: The instructions do not explicitly describe HTML sanitization or escaping for the user-provided messages before they are interpolated into the source code.
Audit Metadata