hyperframes

Pass

Audited by Gen Agent Trust Hub on Sep 19, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill includes a utility to download Node.js dependencies required for its diagnostic scripts.
  • Evidence: The scripts/package-loader.mjs script uses npm install to fetch packages such as @hyperframes/producer and sharp@0.34.5. The installation is performed with the --ignore-scripts flag to prevent unauthorized execution of third-party lifecycle scripts and requires user confirmation via a TTY or a specific environment variable.
  • [DYNAMIC_EXECUTION]: The skill performs runtime loading of internal and utility modules.
  • Evidence: scripts/package-loader.mjs utilizes the import() function to load modules from a temporary directory after they have been successfully bootstrapped via npm.
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to provide local interactive tools.
  • Evidence: references/design-picker.md provides a command to start a background HTTP server using Python's built-in http.server module (python3 -m http.server 8723 &) to host a visual design configuration interface for the user.
  • [SAFE]: The skill references and fetches data from well-known technology platforms and services.
  • Evidence: templates/design-picker.html and references/typography.md fetch assets and metadata from Google Fonts and the JSDelivr CDN. These are documented as safe references for design purposes.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 19, 2026, 04:31 PM