hyperframes-cli

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill makes extensive use of the hyperframes CLI via npx to perform development tasks such as project initialization (init), linting (lint), visual inspection (inspect), and video rendering (render). The init command also facilitates the installation of development-related coding skills into the local environment.
  • [EXTERNAL_DOWNLOADS]: The skill uses npx to fetch and execute the hyperframes package from the npm registry. Additionally, the tts and transcribe commands download external machine learning models (e.g., Whisper) during their first run, and the browser command manages the download of a bundled headless Chrome binary. The upgrade command checks for updates from external sources.
  • [INDIRECT_PROMPT_INJECTION]: The visual inspection feature (npx hyperframes inspect --json) processes project files including index.html and contents of the compositions/ directory.
  • Ingestion points: Source files in the project directory (index.html, compositions/*.html).
  • Boundary markers: The skill does not explicitly define markers to separate project content from agent instructions in its analysis phase.
  • Capability inventory: The CLI can perform file system operations (via init), network serving (preview), and binary execution (render).
  • Sanitization: There is no mention of sanitization for the visual container data or text content processed during the inspection pass.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 09:50 PM