hyperframes-audio
Warn
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The script
scripts/carve.mjsperforms dynamic loading of modules from paths computed at runtime. - Evidence: The
loadCorefunction inscripts/carve.mjsusesrequire.resolveto find the@hyperframes/corepackage relative to the project directory and then uses a dynamicimport()to load the library and its internal modules (audio-carveandaudio-fx). - [COMMAND_EXECUTION]: The skill invokes the
ffmpegbinary to process and decode audio files. - Evidence: The
decodefunction inscripts/carve.mjsusesexecFileSyncto executeffmpegfor audio format conversion. The inputs to this command are derived from thesrcattributes of media elements found in the composition's HTML file. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided HTML files and parses JSON-encoded attributes that drive file-system operations and command execution.
- Ingestion points: The script
scripts/carve.mjsreads the HTML composition file specified by the user via the--compargument. - Boundary markers: The skill relies on structured JSON within HTML attributes (
data-fx-carve,data-fx-chain,data-automation) to define processing instructions. - Capability inventory: The skill has the ability to read and write files (
readFileSync,writeFileSync) and execute system processes (execFileSync). - Sanitization: The script performs basic unescaping of HTML attributes before parsing them as JSON.
- [EXTERNAL_DOWNLOADS]: The skill documentation and scripts specify an external dependency that must be installed via a package manager.
- Evidence:
SKILL.mdandscripts/carve.mjsinstruct the user to install@hyperframes/coreusingnpm i -D @hyperframes/coreto enable the audio analysis functionality.
Audit Metadata