hyperframes-cli

Pass

Audited by Gen Agent Trust Hub on Jul 2, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses npx hyperframes, which fetches and executes the hyperframes package from the npm registry, a well-known package service.
  • [EXTERNAL_DOWNLOADS]: Asset preprocessing commands such as tts, transcribe, and remove-background download specialized machine learning models on their first execution.
  • [COMMAND_EXECUTION]: Instructs the agent to perform environment diagnostics (npx hyperframes doctor), project initialization (npx hyperframes init), and video rendering using shell commands.
  • [PROMPT_INJECTION]: The inspect and lint commands analyze user-authored project files and return summaries or JSON findings to the agent. This represents an indirect prompt injection surface where malicious instructions could be embedded in local HTML or composition files.
  • Ingestion points: Reads index.html and files within the compositions/ directory for analysis.
  • Boundary markers: None identified; audit findings are returned directly to the agent's context window.
  • Capability inventory: Full subprocess execution capabilities via the hyperframes CLI and headless Chrome automation.
  • Sanitization: No explicit sanitization or filtering of project-sourced text is described before it is injected into the agent's context.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 2, 2026, 07:10 PM
Security Audit — agent-trust-hub — hyperframes-cli