cinematic-hyperframes

Pass

Audited by Gen Agent Trust Hub on Sep 24, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches motion design blocks, components, and plugin assets from the official Hyperframes catalog and marketplace.
  • Evidence: references/hyperframes-catalog.md contains instructions to use npx hyperframes add for various blocks and references the heygen-com/hyperframes plugin.
  • [COMMAND_EXECUTION]: The workflow involves executing CLI tools for project management, validation, and rendering.
  • Evidence: SKILL.md and references/hyperframes-catalog.md document the use of npx hyperframes (init, add, inspect, validate), ffmpeg, and ffprobe.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external application code and UI components as source material, creating a potential surface for indirect prompt injection.
  • Ingestion points: SKILL.md (Step 1: Inspect the real app code, design tokens, fonts, UI components, routes, responsive behavior, and copy).
  • Boundary markers: The instructions require the agent to manually rebuild dynamic states as deterministic HTML/CSS/GSAP rather than directly importing untrusted content.
  • Capability inventory: The agent can execute shell commands (CLI tools) and perform file system operations within the project scope.
  • Sanitization: The skill provides clear instructions to "Replace real users, emails, addresses, payments, orders, and private data with realistic mock data" to prevent sensitive data exposure.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 24, 2026, 06:59 AM