hyperframes-animation
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
scripts/package-loader.mjsutility, used by the animation map auditing tool, is designed to automatically install missing dependencies like@hyperframes/producerand@hyperframes/corefrom the npm registry. This process includes several security best practices: it uses version pinning, disables package lifecycle scripts with the--ignore-scriptsflag, and requires explicit user confirmation or an environment variable toggle before execution. - [COMMAND_EXECUTION]: The auditing script
scripts/animation-map.mjsexecutes subprocesses vianode:child_processto manage its dependencies and perform animation audits. The command arguments are passed as an array rather than a shell string, mitigating potential shell injection risks. - [DYNAMIC_EXECUTION]: The skill utilizes dynamic
import()in its bootstrapping logic andpage.evaluatefor its browser-based animation sampling. These are necessary components of the skill's primary purpose—auditing and measuring browser-based animations—and are implemented following standard automation practices. - [SAFE]: No malicious patterns, prompt injections, or unauthorized data exfiltration attempts were detected. The skill's code and documentation are focused entirely on the intended domain of motion design and framework auditing within the HyperFrames ecosystem.
Audit Metadata