The Agent Skills Directory

Dynamic Package Loading: The carve.mjs script utilizes dynamic import() calls to load components from the @hyperframes/core package. It resolves these paths at runtime based on the project's directory structure or a user-provided --core flag. This pattern is used to ensure compatibility with the project's local dependencies but involves executing code from dynamically determined paths.
Subprocess Invocation: To perform audio analysis, the skill executes the ffmpeg binary using child_process.execFileSync. This allows the skill to leverage specialized audio processing tools. Security is managed by passing arguments as an array, though it does interact with an external utility to process files from the workspace.
File System Modification: The skill's primary function involves reading and writing to HTML files in the local workspace. It searches for specific media elements and updates their attributes with processed audio metadata. This requires the agent to have write permissions for the project's source files.
Indirect Prompt Injection Surface: The skill processes untrusted data from HTML attributes in the carve.mjs script (Ingestion points). The script lacks explicit boundary markers for these values (Boundary markers). The skill has the capability to execute external commands via ffmpeg and perform file system writes (Capability inventory). Sanitization is limited to standard JSON parsing and regular expression matching (Sanitization).

hyperframes-audio