The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The script scripts/package-loader.mjs is designed to dynamically download and install the @hyperframes/producer package from the NPM registry at runtime if it is not found locally. This package originates from an organization that is not verified or listed as a trusted vendor, posing a supply chain security risk.
[REMOTE_CODE_EXECUTION]: Following the dynamic installation of dependencies, the skill uses import() to load modules from constructed paths in a temporary directory. The combination of runtime fetching and dynamic loading allows for the execution of external code that is not part of the initial skill distribution.
[COMMAND_EXECUTION]: The skill utilizes node:child_process.spawnSync to execute shell commands, specifically npm install for dependency management and self-execution of the auditing script with modified environment variables. While used for bootstrapping, this represents a powerful capability that could be repurposed for unauthorized operations.
[PROMPT_INJECTION]: The auditing tool scripts/animation-map.mjs executes a browser session that loads and runs code from a user-provided project directory. This environment is potentially vulnerable to indirect prompt injection if project files contain malicious scripts designed to exploit the browser or manipulate the analysis results.
[EXTERNAL_DOWNLOADS]: The animation-map.mjs script starts a local web server to host and serve the contents of the target composition directory. This could lead to local data exposure if the server is accessible by other processes or users on the same network.

hyperframes-animation