hyperframes

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to run various CLI commands using npx hyperframes for linting, validation, inspection, and rendering of video compositions. It also executes a local utility script node skills/hyperframes/scripts/animation-map.mjs to analyze animation choreography.
  • [EXTERNAL_DOWNLOADS]: The generated HTML templates reference the GSAP library from a well-known content delivery network (https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js) to enable animation capabilities. This download targets a well-known service and is standard for web-based animation tools.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from external project files, such as design.md, house-style.md, and variable definitions in JSON format. These files serve as the 'source of truth' for the agent's output, creating a surface where malicious instructions in project data could influence the agent's behavior.
  • Ingestion points: Reads design.md, house-style.md, references/ documentation, and variable files provided via the --variables-file flag.
  • Boundary markers: The instructions do not define specific delimiters or isolation techniques for the content of these project files.
  • Capability inventory: The agent has the ability to execute shell commands (npx, node) and write HTML/JS files to the local file system.
  • Sanitization: There is no mention of sanitizing or validating the content of the imported design and variable files before they are used to generate code.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 09:46 PM