hyperframes-animation

Pass

Audited by Gen Agent Trust Hub on Oct 28, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • Dynamic Dependency Resolution: The skill includes a utility package-loader.mjs designed to download and install framework dependencies (@hyperframes/producer, @hyperframes/core) from npm at runtime if they are not present. While it implements several security measures—such as version pinning, disabling lifecycle scripts with --ignore-scripts, and using temporary directories—this mechanism involves external network requests and code execution.
  • Browser Automation and Script Evaluation: The animation-map.mjs and animation-map-sampling.mjs scripts facilitate the auditing of animations by controlling a browser instance and evaluating JavaScript (page.evaluate) to sample element properties. This is a common pattern for developer tools but constitutes dynamic code execution within a browser environment.
  • Subprocess Execution: The Node.js scripts utilize child_process.spawnSync to manage package installations and to re-spawn the analysis process with a specific NODE_MODULES environment. This represents a functional use of command execution for the skill's operational requirements.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 28, 2026, 05:19 AM