hyperframes-keyframes
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes the
hyperframesCLI tool, which is retrieved and executed from the NPM registry vianpxduring the verification procedure. - [COMMAND_EXECUTION]: The instruction set includes executing shell commands such as
hyperframes lint,hyperframes check, andhyperframes keyframesto validate animation output and snapshots. - [DYNAMIC_EXECUTION]: The skill generates and implements JavaScript animation logic for GSAP, Anime.js, and WebGL by interpolating user-defined requirements into predefined code skeletons.
- [INDIRECT_PROMPT_INJECTION]: The skill interprets 'Creator requests' to define animated subjects and pose ladders, presenting an injection surface for untrusted data.
- Ingestion points: Animation specifications and subjects are derived directly from user prompts and scene descriptions (SKILL.md).
- Boundary markers: No specific delimiters or safety warnings for handling embedded instructions within user requests are provided.
- Capability inventory: The skill possesses the ability to execute shell commands via
npxand run browser-side JavaScript within a composition context (SKILL.md). - Sanitization: There are no explicit instructions to sanitize or validate prompt-sourced values before they are integrated into the generated animation code.
Audit Metadata