hyperframes
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
scripts/setup.shscript installs thehyperframesCLI globally from the npm registry and usesnpx puppeteerto download thechrome-headless-shellbrowser for high-performance video rendering. - [EXTERNAL_DOWNLOADS]: The
npx hyperframes addcommand allows the agent to fetch and install additional video components, such as shader transitions and social overlays, from thehyperframes.heygen.comcatalog. - [EXTERNAL_DOWNLOADS]: Local AI capabilities for text-to-speech (Kokoro) and transcription (Whisper) download their respective model files to a local cache folder during first-time use.
- [COMMAND_EXECUTION]: The skill requires and executes multiple system-level CLI tools including
node,npm,npx, andffmpegto manage project scaffolding, linting, and final video encoding. - [INDIRECT_PROMPT_INJECTION]: The
capturefunctionality described inreferences/website-to-video.mdcreates a surface for indirect prompt injection by ingesting text and assets from arbitrary external URLs. - Ingestion points: The
hyperframes capture <url>command (documented inreferences/cli.md) retrieves content from external websites into the local project directory. - Boundary markers: The provided instructions do not specify the use of delimiters or specific safety instructions to isolate captured content from the agent's primary task flow.
- Capability inventory: The skill possesses extensive capabilities including headless browser execution (
render), file system access, and network operations through the CLI. - Sanitization: No explicit sanitization or filtering of the captured web content is mentioned in the skill documentation.
Audit Metadata