general-video

Pass

Audited by Gen Agent Trust Hub on Aug 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the npx hyperframes CLI tool and local Node.js scripts (e.g., frame-packets.mjs, prefs.mjs, recipe.mjs) to manage project initialization, authentication status, and the rendering pipeline.
  • [EXTERNAL_DOWNLOADS]: The skill fetches assets and design tokens from figma.com URLs and uses npx to execute tools, which may involve downloading packages from the registry.
  • [DYNAMIC_EXECUTION]: The skill dynamically generates sub-agent role definitions (_role.md) by concatenating the core framework contract with skill-specific instructions at runtime before dispatching scene-building tasks.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources and local project files to drive the video generation process.
  • Ingestion points: Project configuration files (BRIEF.md, STORYBOARD.md) and assets from figma.com URLs.
  • Boundary markers: The workflow relies on the brief-contract.md specification and canonical term enforcement to maintain structure, though explicit prompt delimiters for external content are handled by the underlying frame-packets-core.mjs library.
  • Capability inventory: File system write operations for HTML and JSON artifacts, shell command execution via the HyperFrames toolchain, and sub-agent task delegation.
  • Sanitization: Implements mandatory validation phases using npx hyperframes lint and npx hyperframes check to ensure generated compositions adhere to structural and deterministic layout rules.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 19, 2026, 03:14 AM
Security Audit — agent-trust-hub — general-video