hyperframes-cli
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of the
hyperframesCLI vianpxto perform development tasks such as project initialization (init), linting (lint), visual inspection (inspect), and video rendering (render). Theinitcommand also facilitates the installation of development-related coding skills into the local environment. - [EXTERNAL_DOWNLOADS]: The skill uses
npxto fetch and execute thehyperframespackage from the npm registry. Additionally, thettsandtranscribecommands download external machine learning models (e.g., Whisper) during their first run, and thebrowsercommand manages the download of a bundled headless Chrome binary. Theupgradecommand checks for updates from external sources. - [INDIRECT_PROMPT_INJECTION]: The visual inspection feature (
npx hyperframes inspect --json) processes project files includingindex.htmland contents of thecompositions/directory. - Ingestion points: Source files in the project directory (
index.html,compositions/*.html). - Boundary markers: The skill does not explicitly define markers to separate project content from agent instructions in its analysis phase.
- Capability inventory: The CLI can perform file system operations (via
init), network serving (preview), and binary execution (render). - Sanitization: There is no mention of sanitization for the visual container data or text content processed during the inspection pass.
Audit Metadata