hyperframes
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides a robust and well-documented framework for professional video production using standard web technologies.
- [EXTERNAL_DOWNLOADS]: The skill references the GSAP library from a well-known CDN (jsDelivr) and describes the download of local AI models (Kokoro-82M) for text-to-speech functionality. These are standard resources for the skill's intended purpose.
- [COMMAND_EXECUTION]: The skill includes Node.js utility scripts (
animation-map.mjsandcontrast-report.mjs) used for project validation. These scripts execute shell commands vianpxto interact with the project's CLI and use Puppeteer for browser-based introspection. - [DYNAMIC_EXECUTION]: Diagnostic scripts utilize Puppeteer's
evaluatefunction to measure DOM elements and GSAP timelines in a controlled browser environment. - [INDIRECT_PROMPT_INJECTION]: The skill identifies a potential attack surface through the ingestion of external transcript and audio data files. This is documented with clear guidance on quality checks and sanitization of transcript tokens (e.g., removing non-speech markers), and the data is primarily used to drive animation timing rather than logic.
Audit Metadata