hyperframes-core
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and fetches standard libraries from well-known registries to support composition functionality.
- Fetches the GSAP animation library from the JSDelivr CDN (
https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js). - Uses a pinned version of the Tailwind CSS browser runtime (@tailwindcss/browser@4.2.4) as described in the Tailwind reference.
- [COMMAND_EXECUTION]: The skill uses vendor-provided CLI tools for auditing and processing project files.
- Commands such as
npx hyperframes check,npx hyperframes timeline, andnpx hyperframes renderare employed for linting, layout analysis, and final video generation. - [INDIRECT_PROMPT_INJECTION]: The framework processes external HTML and variable data, utilizing isolation mechanisms to mitigate injection risks.
- Ingestion points: Data is ingested via
data-composition-srcattributes for sub-compositions anddata-variable-valuesJSON for runtime parameters. - Boundary markers: The framework uses
<template>tags as mandatory transport containers and enforces strict linting rules (e.g.,media_crossorigin_breaks_preview) to ensure secure and deterministic behavior. - Capability inventory: The framework supports frame-accurate seeking, media playback, and GSAP timeline execution.
- Sanitization: The runtime assembly process discards all content outside the
<template>element, including the<head>and associated scripts/styles not explicitly placed inside the template.
Audit Metadata