orbit-card
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a legitimate 3D rendering component. Its functionality is focused on visualizing a 'feature card' orbiting a sphere using the Three.js and GSAP libraries. All assets, including fonts and JavaScript libraries, are stored locally within the skill's directory structure.
- [COMMAND_EXECUTION]: The skill documentation provides instructions for users to install and render the component using the
npx hyperframescommand. These are standard operations for the HyperFrames ecosystem and do not pose an inherent security risk in the context of the skill's intended use. - [INDIRECT_PROMPT_INJECTION]: The skill defines variables such as
feature1Titleandfeature1Descthat are ingested at runtime viawindow.__hyperframes.getVariables(). These inputs are rendered into a 2D canvas to create a texture for the 3D scene. While this represents an ingestion point for untrusted data, the skill lacks any capabilities (like network access, file system writes, or shell execution) that could be exploited through this surface. Furthermore, the data is rendered as text on a canvas, which does not provide a path for code execution or prompt manipulation.
Audit Metadata