hyperframes-cli
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on the
npx hyperframescommand suite to perform project tasks. This involves executing Node.js code to scaffold projects, serve local web content, and manage rendering workflows that utilize Chrome and FFmpeg.\n- [EXTERNAL_DOWNLOADS]: The CLI is designed to download AI models (e.g., for transcription and background removal) and check for software updates from the developer's infrastructure during normal operation.\n- [INDIRECT_PROMPT_INJECTION]: The tool processes local HTML, JavaScript, and JSON configuration files which are rendered in a headless browser. This creates an attack surface where maliciously crafted local files could attempt to influence the rendering environment.\n - Ingestion points: Reads
index.html, composition directories, and JSON strings passed via the--variablesflag.\n - Boundary markers: No specific delimiters or safety warnings for embedded content are described in the instructions.\n
- Capability inventory: Capabilities include file system writes, subprocess execution (Chrome, FFmpeg), and starting a local HTTP server for previews.\n
- Sanitization: Input sanitization and validation are managed internally by the CLI package.
Audit Metadata