hyperframes
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run various CLI commands using
npx hyperframesfor linting, validation, inspection, and rendering of video compositions. It also executes a local utility scriptnode skills/hyperframes/scripts/animation-map.mjsto analyze animation choreography. - [EXTERNAL_DOWNLOADS]: The generated HTML templates reference the GSAP library from a well-known content delivery network (
https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js) to enable animation capabilities. This download targets a well-known service and is standard for web-based animation tools. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from external project files, such as
design.md,house-style.md, and variable definitions in JSON format. These files serve as the 'source of truth' for the agent's output, creating a surface where malicious instructions in project data could influence the agent's behavior. - Ingestion points: Reads
design.md,house-style.md,references/documentation, and variable files provided via the--variables-fileflag. - Boundary markers: The instructions do not define specific delimiters or isolation techniques for the content of these project files.
- Capability inventory: The agent has the ability to execute shell commands (
npx,node) and write HTML/JS files to the local file system. - Sanitization: There is no mention of sanitizing or validating the content of the imported design and variable files before they are used to generate code.
Audit Metadata