The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The script scripts/package-loader.mjs contains logic to download and install packages from the NPM registry using the npm install command. This mechanism is used to bootstrap required tools like @hyperframes/producer if they are not already present in the environment. The script uses the --ignore-scripts flag during installation to mitigate risks from malicious package lifecycle scripts.
[DYNAMIC_EXECUTION]: The auditing script scripts/animation-map.mjs uses import() to dynamically load modules from a temporary directory managed by the package loader. Additionally, it utilizes page.evaluate() within its analysis session to execute JavaScript in a browser context for measuring DOM elements and inspecting animation states.
[COMMAND_EXECUTION]: The utility script scripts/package-loader.mjs uses child_process.spawnSync to execute the npm binary for dependency management and to re-execute the Node.js process with the updated environment.
[INDIRECT_PROMPT_INJECTION]: The auditing script scripts/animation-map.mjs ingests content from a user-specified composition directory. If this directory contains malicious HTML or JavaScript code, it could potentially influence the behavior of the auditing tool or the agent processing its output.

hyperframes-animation