hyperframes-registry
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches registry manifests and component data from the official HyperFrames GitHub repository (
heygen-com/hyperframes). These operations are necessary for registry discovery and item installation. - [INDIRECT_PROMPT_INJECTION]: The skill involves reading and merging HTML, CSS, and JavaScript snippets from external registry files into the local project environment. This represents a potential surface for indirect prompt injection if the registry content were compromised.
- Ingestion points: Content is ingested via the
hyperframes addcommand and by reading installed files incompositions/. - Boundary markers: None identified; the agent is instructed to merge the content directly based on file structure.
- Capability inventory: The agent uses file read/write operations and the
hyperframesCLI tool to manage project files. - Sanitization: No explicit sanitization or validation of the fetched snippets is mentioned before integration.
Audit Metadata