hyperframes-audio

Warn

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [DYNAMIC_EXECUTION]: The script scripts/carve.mjs performs dynamic loading of modules from paths computed at runtime.
  • Evidence: The loadCore function in scripts/carve.mjs uses require.resolve to find the @hyperframes/core package relative to the project directory and then uses a dynamic import() to load the library and its internal modules (audio-carve and audio-fx).
  • [COMMAND_EXECUTION]: The skill invokes the ffmpeg binary to process and decode audio files.
  • Evidence: The decode function in scripts/carve.mjs uses execFileSync to execute ffmpeg for audio format conversion. The inputs to this command are derived from the src attributes of media elements found in the composition's HTML file.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided HTML files and parses JSON-encoded attributes that drive file-system operations and command execution.
  • Ingestion points: The script scripts/carve.mjs reads the HTML composition file specified by the user via the --comp argument.
  • Boundary markers: The skill relies on structured JSON within HTML attributes (data-fx-carve, data-fx-chain, data-automation) to define processing instructions.
  • Capability inventory: The skill has the ability to read and write files (readFileSync, writeFileSync) and execute system processes (execFileSync).
  • Sanitization: The script performs basic unescaping of HTML attributes before parsing them as JSON.
  • [EXTERNAL_DOWNLOADS]: The skill documentation and scripts specify an external dependency that must be installed via a package manager.
  • Evidence: SKILL.md and scripts/carve.mjs instruct the user to install @hyperframes/core using npm i -D @hyperframes/core to enable the audio analysis functionality.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 9, 2026, 06:49 AM