hyperframes-registry
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches registry metadata and manifest information from HeyGen's official GitHub repository (heygen-com/hyperframes) via curl.
- [COMMAND_EXECUTION]: The skill utilizes the hyperframes add command to download and install project-specific blocks and components.
- [INDIRECT_PROMPT_INJECTION]: The skill involves the ingestion of external code snippets from a remote registry into the local development environment. Ingestion points: Files downloaded via the add command and manifests fetched from GitHub. Boundary markers: The instructions do not define specific delimiters or warnings for the agent when processing the content of these external files. Capability inventory: The agent is instructed to read installed files and merge their HTML, CSS, and JS contents into the user's project. Sanitization: No validation or sanitization steps are specified for the incoming code snippets before they are integrated into the host application.
- [DYNAMIC_EXECUTION]: The skill instructs the agent to manually assemble and merge JavaScript logic from components into the primary project script, which constitutes the runtime integration of externally sourced code.
Audit Metadata