hyperframes-core
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes project files that are likely to contain user-supplied data, creating a surface for indirect prompt injection.
- Ingestion points: The library
scripts/lib/frame-packets-core.mjsreadsSTORYBOARD.md,frame.md, andSCRIPT.mdfrom the project directory. - Boundary markers: Content from these files is inlined directly into 'frame packets' (e.g.,
.hyperframes/frame-packets/<id>.md) using standard Markdown headers (e.g.,## Assigned storyboard block), but lacks robust escaping or 'ignore' instructions for the embedded content. - Capability inventory: The system uses these packets to prompt sub-agents that have access to file-writing tools (
writeFileSync), directory creation (mkdirSync), and internal project scripts. - Sanitization: No sanitization or filtering is performed on the extracted content before it is inlined into the sub-agent's prompt context.
- [COMMAND_EXECUTION]: The skill relies on and documents the execution of various CLI tools and scripts.
- The documentation in
references/brief-contract.mddescribes executing a Node.js script from an external skill directory:node <MEDIA_DIR>/scripts/prefs.mjs get --hyperframes <MEMORY_ROOT> --json. - The
SKILL.mdfile instructs the agent to usenpx hyperframesfor checking, snapshotting, and rendering projects. - [DYNAMIC_EXECUTION]: The framework's core design involves executing scripts at runtime within the composition environment.
references/sub-compositions.mdexplains that the runtime fetches HTML files, parses them, and executes<script>tags found inside<template>elements.references/determinism-rules.mdnotes that these scripts are used to register timelines onwindow.__timelinesand drive animations frame-by-frame.- [EXTERNAL_DOWNLOADS]: The skill references external resources for animation and styling from well-known services.
- Compositions fetch the GSAP animation library from
https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js. - Tailwind projects utilize the browser runtime from a pinned version of
@tailwindcss/browser@4.2.4.
Audit Metadata