hyperframes
Warn
Audited by Gen Agent Trust Hub on May 9, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The
scripts/package-loader.mjsutility implements a dynamic dependency bootstrapping mechanism. It utilizesnpm installto fetch and install Node.js packages, such as@hyperframes/producerandsharp, into a temporary directory at runtime. While the script incorporates several security safeguards—including the--ignore-scriptsflag, pinning of package versions, and a user-confirmation gate—it facilitates the automated download and execution of external code. - [COMMAND_EXECUTION]: The skill's workflow relies on the execution of shell commands in the agent's environment. This includes the use of
npxto run HyperFrames CLI tools,nodeto execute internal analysis scripts, andcurlorwgetto interact with external services for transcription tasks. - [DYNAMIC_EXECUTION]: Internal auditing tools, specifically
animation-map.mjsandcontrast-report.mjs, orchestrate a headless browser to perform visual analysis of video compositions. This process involves executing JavaScript within the browser context to perform DOM introspection and accessibility audits. Additionally,package-loader.mjsuses dynamicimport()statements to load modules from paths computed at runtime. - [EXTERNAL_DOWNLOADS]: The skill provides instructions and examples for downloading remote assets, including the GSAP library from a CDN, transcription data from third-party APIs (such as OpenAI and Groq), and pre-trained machine learning models for text-to-speech (Kokoro-82M).
Audit Metadata