The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches registry metadata from the vendor's official GitHub repository (heygen-com/hyperframes) and offers an optional download of a ~33MB machine learning model for local semantic search. These resources are served from the vendor's controlled infrastructure and well-known CDNs like jsDelivr.
[COMMAND_EXECUTION]: The skill uses the hyperframes CLI (via npx) to perform catalog searches, install components, and run linting/preview tools. These commands are standard for the skill's purpose as a developer registry.
[DATA_EXFILTRATION]: A usage beacon (npx hyperframes events) reports skill usage to the vendor. Additionally, the feedback command allows users to manually report missing items to the vendor, including the search query used. These behaviors are transparently documented as telemetry and feedback mechanisms.
[INDIRECT_PROMPT_INJECTION]: The catalog --query command processes natural language search terms. While this creates a surface for potential shell command injection if input is unsanitized, the instructions mitigate this by demonstrating the use of double-quoting for the query argument.
Ingestion points: SKILL.md and search.md define the --query parameter for user-provided strings.
Boundary markers: Examples utilize double quotes to encapsulate query text.
Capability inventory: The skill performs shell execution of npx hyperframes commands.
Sanitization: Instructions rely on standard shell quoting practices and a local-first processing model.

hyperframes-registry