hyperframes
Warn
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/package-loader.mjsusesspawnSyncto executenpm installcommands for bootstrapping missing dependencies into a temporary directory. - [EXTERNAL_DOWNLOADS]: The skill's bootstrapping mechanism downloads Node.js packages from the npm registry at runtime.
- [REMOTE_CODE_EXECUTION]: Dependencies downloaded by the bootstrap process are dynamically loaded and executed using the
import()function withinscripts/package-loader.mjs. - [COMMAND_EXECUTION]: Instructions in
references/design-picker.mddirect the agent to execute a shell command to start a local Python HTTP server (python3 -m http.server) to facilitate the visual design picker interface.
Audit Metadata