The Agent Skills Directory

[DYNAMIC_EXECUTION]: The helper script scripts/package-loader.mjs uses the dynamic import() statement to load Node.js modules from paths resolved at runtime (e.g., within node_modules). This pattern can be exploited if an attacker can influence the package resolution path.
[EXTERNAL_DOWNLOADS]: The scripts/package-loader.mjs file is designed to automatically download missing dependencies using npm install. While it includes a confirmation prompt for interactive sessions and enforces version pinning, it represents a runtime network dependency and external code ingestion.
[COMMAND_EXECUTION]: The skill uses node:child_process (spawnSync) in scripts/package-loader.mjs to execute the npm or npm.cmd CLI for bootstrapping dependencies. This execution of shell commands is used for system-level setup during script execution.
[INDIRECT_PROMPT_INJECTION]: The scripts/animation-map.mjs tool processes user-provided composition directories and evaluates JavaScript within a headless browser context (session.page.evaluate). This creates a vulnerability surface where malicious code embedded in a composition file could be executed when the auditing script is run.

hyperframes-animation