hyperframes
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a website-to-video workflow using the
npx hyperframes capture <url>command, which ingests content from arbitrary external websites. This content is then used by the agent to generate design tokens, scripts, and storyboards without explicit sanitization or boundary markers to prevent the ingestion of malicious instructions. - [EXTERNAL_DOWNLOADS]: The
scripts/setup.shscript performs a global installation of thehyperframesCLI tool from the public npm registry and downloads thechrome-headless-shellbinary via Puppeteer. Additionally, the skill includes external JavaScript libraries like GSAP from thecdn.jsdelivr.netCDN. - [COMMAND_EXECUTION]: The instructions include commands to terminate system processes using
pkilland execute a local setup script viabash. The tool relies extensively onnpxfor executing various CLI tasks such as capturing, rendering, and media processing.
Audit Metadata