hyperframes
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes a utility to download Node.js dependencies required for its diagnostic scripts.
- Evidence: The
scripts/package-loader.mjsscript usesnpm installto fetch packages such as@hyperframes/producerandsharp@0.34.5. The installation is performed with the--ignore-scriptsflag to prevent unauthorized execution of third-party lifecycle scripts and requires user confirmation via a TTY or a specific environment variable. - [DYNAMIC_EXECUTION]: The skill performs runtime loading of internal and utility modules.
- Evidence:
scripts/package-loader.mjsutilizes theimport()function to load modules from a temporary directory after they have been successfully bootstrapped vianpm. - [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to provide local interactive tools.
- Evidence:
references/design-picker.mdprovides a command to start a background HTTP server using Python's built-inhttp.servermodule (python3 -m http.server 8723 &) to host a visual design configuration interface for the user. - [SAFE]: The skill references and fetches data from well-known technology platforms and services.
- Evidence:
templates/design-picker.htmlandreferences/typography.mdfetch assets and metadata from Google Fonts and the JSDelivr CDN. These are documented as safe references for design purposes.
Audit Metadata