hyperframes
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a suite of CLI tools via
npx hyperframes(init, lint, preview, render, transcribe, tts) and custom Node.js scripts (animation-map.mjs,contrast-report.mjs) to automate the production pipeline. These commands are integral to the framework's functionality for rendering and validating video compositions. - [EXTERNAL_DOWNLOADS]: The framework fetches the GSAP animation library from the jsDelivr CDN and downloads text-to-speech models (Kokoro-82M) to a local cache (~311 MB) during initial use. These are standard operations for the provided media tools.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, specifically audio transcripts and project-specific design files (
DESIGN.md), to influence the generation of visual styles and captions. While this represents a potential attack surface, the risk is mitigated by the specific, non-executable nature of the ingested data and the scoped environment of the rendering scripts.
Audit Metadata