hyperframes

Warn

Audited by Gen Agent Trust Hub on May 9, 2026

Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The scripts/package-loader.mjs utility implements a dynamic dependency bootstrapping mechanism. It utilizes npm install to fetch and install Node.js packages, such as @hyperframes/producer and sharp, into a temporary directory at runtime. While the script incorporates several security safeguards—including the --ignore-scripts flag, pinning of package versions, and a user-confirmation gate—it facilitates the automated download and execution of external code.
  • [COMMAND_EXECUTION]: The skill's workflow relies on the execution of shell commands in the agent's environment. This includes the use of npx to run HyperFrames CLI tools, node to execute internal analysis scripts, and curl or wget to interact with external services for transcription tasks.
  • [DYNAMIC_EXECUTION]: Internal auditing tools, specifically animation-map.mjs and contrast-report.mjs, orchestrate a headless browser to perform visual analysis of video compositions. This process involves executing JavaScript within the browser context to perform DOM introspection and accessibility audits. Additionally, package-loader.mjs uses dynamic import() statements to load modules from paths computed at runtime.
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions and examples for downloading remote assets, including the GSAP library from a CDN, transcription data from third-party APIs (such as OpenAI and Groq), and pre-trained machine learning models for text-to-speech (Kokoro-82M).
Audit Metadata
Risk Level
MEDIUM
Analyzed
May 9, 2026, 04:29 AM
Security Audit — agent-trust-hub — hyperframes