cinematic-hyperframes
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches motion design blocks, components, and plugin assets from the official Hyperframes catalog and marketplace.
- Evidence:
references/hyperframes-catalog.mdcontains instructions to usenpx hyperframes addfor various blocks and references theheygen-com/hyperframesplugin. - [COMMAND_EXECUTION]: The workflow involves executing CLI tools for project management, validation, and rendering.
- Evidence:
SKILL.mdandreferences/hyperframes-catalog.mddocument the use ofnpx hyperframes(init, add, inspect, validate),ffmpeg, andffprobe. - [INDIRECT_PROMPT_INJECTION]: The skill processes external application code and UI components as source material, creating a potential surface for indirect prompt injection.
- Ingestion points:
SKILL.md(Step 1: Inspect the real app code, design tokens, fonts, UI components, routes, responsive behavior, and copy). - Boundary markers: The instructions require the agent to manually rebuild dynamic states as deterministic HTML/CSS/GSAP rather than directly importing untrusted content.
- Capability inventory: The agent can execute shell commands (CLI tools) and perform file system operations within the project scope.
- Sanitization: The skill provides clear instructions to "Replace real users, emails, addresses, payments, orders, and private data with realistic mock data" to prevent sensitive data exposure.
Audit Metadata