skills/connorads/dotfiles/hyperframes/Gen Agent Trust Hub

hyperframes

Pass

Audited by Gen Agent Trust Hub on May 8, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The package-loader.mjs script facilitates the runtime installation of missing Node.js dependencies required by the auditing tools.
  • It installs @hyperframes/producer (a vendor-scoped resource) and sharp ( a well-known image processing library) from the official NPM registry.
  • The implementation uses the --ignore-scripts flag to mitigate Risks of remote code execution during the installation process.
  • The bootstrap process is guarded by a manual confirmation prompt (in TTY environments) or a specific environment variable requirement.
  • [COMMAND_EXECUTION]: The skill uses node:child_process to manage its environment and perform analysis tasks.
  • package-loader.mjs executes npm install and re-spawns Node.js processes to incorporate bootstrapped dependencies.
  • Various documentation files (SKILL.md, references/transcript-guide.md) instruct the agent to use CLI tools like npx hyperframes for linting, validation, and transcription tasks.
  • [DYNAMIC_EXECUTION]: The animation-map.mjs and contrast-report.mjs scripts use a headless browser (via Puppeteer/Playwright in the producer package) to execute JavaScript within the context of the HTML compositions.
  • This execution is used to programmatically measure element bounding boxes, compute contrast ratios, and extract timeline data for auditing purposes.
  • [DATA_EXPOSURE]: The analysis scripts read local project files, including HTML compositions and configuration metadata, to generate reports. This access is necessary for the skill's primary function of video production and quality assurance.
Audit Metadata
Risk Level
SAFE
Analyzed
May 8, 2026, 09:09 AM