hyperframes-cli
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the execution of the
hyperframesCLI tool usingnpx. This allows the agent to perform project initialization, video rendering, linting, and environment troubleshooting. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes various external data formats, creating a potential attack surface for indirect prompt injection.
- Ingestion points: Reads and processes
index.html, HTML files incompositions/, and external media files for transcription (e.g.,.mp3,.mp4,.srt). - Boundary markers: The instructions do not define clear delimiters or specific warnings to ignore instructions that might be embedded within the project's HTML or metadata files.
- Capability inventory: The skill performs file system operations (scaffolding projects, writing render outputs), executes shell commands via
npx, and manages a bundled browser instance (hyperframes browser). - Sanitization: There is no evidence of content sanitization or validation for the HTML compositions or transcription inputs before processing.
Audit Metadata