slideshow
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run
npx hyperframes skills update slideshowto keep the skill and its dependencies current. This involves shell execution of the vendor's specific toolset. - [REMOTE_CODE_EXECUTION]: The use of
npxfor updates involves fetching and executing code from the npm registry. This is part of the intended functionality for maintaining the HyperFrames developer environment. - [EXTERNAL_DOWNLOADS]: The skill references external assets, including the Three.js library from the JSDelivr CDN and asset exports from Figma URLs. These are standard integrations for building interactive web-based presentations.
- [PROMPT_INJECTION]: The documentation includes a directive to perform updates "silently" and without asking for user confirmation. While this attempts to bypass typical interaction checkpoints, it is explicitly scoped to the maintenance of the vendor's own framework components.
Audit Metadata