website-to-hyperframes

SUSPICIOUS. The core behavior matches the stated purpose and uses an official same-org npm tool, so this is not fundamentally incompatible or overtly malicious. The main risks are unpinned `npx` supply-chain exposure, transitive skill loading, and especially fetching arbitrary websites while the agent also has write/exec capabilities, which creates meaningful indirect prompt-injection risk.