hyperframes-cli
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for executing various CLI commands via
npx hyperframes, including project initialization, linting, previewing, and rendering. These are standard development workflows for the framework. - [EXTERNAL_DOWNLOADS]: The skill utilizes
npx, which downloads and executes the latest version of thehyperframespackage from the npm registry. It also references the official HyperFrames GitHub repository (heygen-com/hyperframes) for source and documentation. - [INDIRECT_PROMPT_INJECTION]: The skill processes external project files (HTML, JavaScript, and media) during linting and rendering. There is a theoretical risk that malicious content within these files could attempt to influence the agent's behavior if the tool's output is consumed by the agent without sanitization.
- Ingestion points: Files in
./,compositions/, and media files likeclip.mp4ortrack.mp3. - Boundary markers: Not explicitly defined in the CLI instructions.
- Capability inventory: File system access, network access (via npm/transcription), and subprocess execution (via FFmpeg/Chrome).
- Sanitization: Not documented; relies on the internal security of the HyperFrames CLI tool.
Audit Metadata