hyperframes-core

Pass

Audited by Gen Agent Trust Hub on Sep 21, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references and fetches standard libraries from well-known registries to support composition functionality.
  • Fetches the GSAP animation library from the JSDelivr CDN (https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js).
  • Uses a pinned version of the Tailwind CSS browser runtime (@tailwindcss/browser@4.2.4) as described in the Tailwind reference.
  • [COMMAND_EXECUTION]: The skill uses vendor-provided CLI tools for auditing and processing project files.
  • Commands such as npx hyperframes check, npx hyperframes timeline, and npx hyperframes render are employed for linting, layout analysis, and final video generation.
  • [INDIRECT_PROMPT_INJECTION]: The framework processes external HTML and variable data, utilizing isolation mechanisms to mitigate injection risks.
  • Ingestion points: Data is ingested via data-composition-src attributes for sub-compositions and data-variable-values JSON for runtime parameters.
  • Boundary markers: The framework uses <template> tags as mandatory transport containers and enforces strict linting rules (e.g., media_crossorigin_breaks_preview) to ensure secure and deterministic behavior.
  • Capability inventory: The framework supports frame-accurate seeking, media playback, and GSAP timeline execution.
  • Sanitization: The runtime assembly process discards all content outside the <template> element, including the <head> and associated scripts/styles not explicitly placed inside the template.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 21, 2026, 03:22 AM
Security Audit — agent-trust-hub — hyperframes-core