hyperframes-keyframes

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill utilizes the hyperframes CLI tool, which is retrieved and executed from the NPM registry via npx during the verification procedure.
  • [COMMAND_EXECUTION]: The instruction set includes executing shell commands such as hyperframes lint, hyperframes check, and hyperframes keyframes to validate animation output and snapshots.
  • [DYNAMIC_EXECUTION]: The skill generates and implements JavaScript animation logic for GSAP, Anime.js, and WebGL by interpolating user-defined requirements into predefined code skeletons.
  • [INDIRECT_PROMPT_INJECTION]: The skill interprets 'Creator requests' to define animated subjects and pose ladders, presenting an injection surface for untrusted data.
  • Ingestion points: Animation specifications and subjects are derived directly from user prompts and scene descriptions (SKILL.md).
  • Boundary markers: No specific delimiters or safety warnings for handling embedded instructions within user requests are provided.
  • Capability inventory: The skill possesses the ability to execute shell commands via npx and run browser-side JavaScript within a composition context (SKILL.md).
  • Sanitization: There are no explicit instructions to sanitize or validate prompt-sourced values before they are integrated into the generated animation code.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 06:49 AM