general-video
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
npx hyperframesCLI tool and local Node.js scripts (e.g.,frame-packets.mjs,prefs.mjs,recipe.mjs) to manage project initialization, authentication status, and the rendering pipeline. - [EXTERNAL_DOWNLOADS]: The skill fetches assets and design tokens from
figma.comURLs and usesnpxto execute tools, which may involve downloading packages from the registry. - [DYNAMIC_EXECUTION]: The skill dynamically generates sub-agent role definitions (
_role.md) by concatenating the core framework contract with skill-specific instructions at runtime before dispatching scene-building tasks. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources and local project files to drive the video generation process.
- Ingestion points: Project configuration files (
BRIEF.md,STORYBOARD.md) and assets fromfigma.comURLs. - Boundary markers: The workflow relies on the
brief-contract.mdspecification and canonical term enforcement to maintain structure, though explicit prompt delimiters for external content are handled by the underlyingframe-packets-core.mjslibrary. - Capability inventory: File system write operations for HTML and JSON artifacts, shell command execution via the HyperFrames toolchain, and sub-agent task delegation.
- Sanitization: Implements mandatory validation phases using
npx hyperframes lintandnpx hyperframes checkto ensure generated compositions adhere to structural and deterministic layout rules.
Audit Metadata