hyperframes-cli
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npx hyperframes, which fetches and executes thehyperframespackage from the npm registry, a well-known package service. - [EXTERNAL_DOWNLOADS]: Asset preprocessing commands such as
tts,transcribe, andremove-backgrounddownload specialized machine learning models on their first execution. - [COMMAND_EXECUTION]: Instructs the agent to perform environment diagnostics (
npx hyperframes doctor), project initialization (npx hyperframes init), and video rendering using shell commands. - [PROMPT_INJECTION]: The
inspectandlintcommands analyze user-authored project files and return summaries or JSON findings to the agent. This represents an indirect prompt injection surface where malicious instructions could be embedded in local HTML or composition files. - Ingestion points: Reads
index.htmland files within thecompositions/directory for analysis. - Boundary markers: None identified; audit findings are returned directly to the agent's context window.
- Capability inventory: Full subprocess execution capabilities via the
hyperframesCLI and headless Chrome automation. - Sanitization: No explicit sanitization or filtering of project-sourced text is described before it is injected into the agent's context.
Audit Metadata