hyperframes-fx
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands using
npx hyperframesto manage project components, lint files, and render video outputs. - [REMOTE_CODE_EXECUTION]: It uses
npxto download and execute visual effect packages (slugs) from the NPM registry at runtime. - [EXTERNAL_DOWNLOADS]: Transitions, overlays, and UI blocks are fetched from external package repositories during the setup and installation phases.
- [PROMPT_INJECTION]: The skill reads local
index.htmlfiles to identify card templates and layout, which serves as a potential ingestion point for indirect prompt injection. - Ingestion points: Reads and parses
<div class="card clip ...">tags from the project'sindex.htmlfile. - Boundary markers: Absent; the skill relies on the existing HTML structure.
- Capability inventory: Shell command execution (
npx) and modification of project files. - Sanitization: Absent; the logic directly uses parsed class names and tag order to determine selection and timing parameters.
Audit Metadata