The Agent Skills Directory

Automated Dependency Management: The skill utilizes a package-loader.mjs script to bootstrap necessary Node.js libraries (@hyperframes/producer, @hyperframes/core, and sharp) if they are missing from the environment. This process is restricted by the --ignore-scripts flag to prevent unauthorized execution of package lifecycle scripts and uses pinned versions for determinism.
Controlled Command Execution: Utility scripts perform local operations such as audio extraction and contrast reporting by invoking system binaries like ffmpeg, node, and npm. These calls are implemented using subprocess.run and spawnSync without shell interpolation, which effectively mitigates command injection risks.
External Resource Integration: The skill integrates well-known external resources, including the GSAP animation library via the jsDelivr CDN and font metadata from Google. These references are standard for the tool's creative purpose and originate from reputable, well-known services.
Indirect Prompt Injection Surface: The visual picker workflow processes user-provided design tokens from frame.md files and interpolates them into HTML templates. While this creates a potential surface for indirect injection if a user processes untrusted design specifications, the implementation is intended for local design iteration, and the instructions explicitly guide the agent to ensure architecture previews do not contain executable scripts or event handlers.

hyperframes-creative