hyperframes-animation

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The scripts/package-loader.mjs utility, used by the animation map auditing tool, is designed to automatically install missing dependencies like @hyperframes/producer and @hyperframes/core from the npm registry. This process includes several security best practices: it uses version pinning, disables package lifecycle scripts with the --ignore-scripts flag, and requires explicit user confirmation or an environment variable toggle before execution.
  • [COMMAND_EXECUTION]: The auditing script scripts/animation-map.mjs executes subprocesses via node:child_process to manage its dependencies and perform animation audits. The command arguments are passed as an array rather than a shell string, mitigating potential shell injection risks.
  • [DYNAMIC_EXECUTION]: The skill utilizes dynamic import() in its bootstrapping logic and page.evaluate for its browser-based animation sampling. These are necessary components of the skill's primary purpose—auditing and measuring browser-based animations—and are implemented following standard automation practices.
  • [SAFE]: No malicious patterns, prompt injections, or unauthorized data exfiltration attempts were detected. The skill's code and documentation are focused entirely on the intended domain of motion design and framework auditing within the HyperFrames ecosystem.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 06:50 AM