hyperframes-animation
Warn
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The utility script
scripts/package-loader.mjsimplements a custom module loading system. It usesimport()to load Node.js modules from file URLs computed at runtime. It also performs process re-execution by spawning a new Node.js instance with modified environment variables (NODE_MODULES_ENV) to inject newly installed dependencies into the process. - [DYNAMIC_EXECUTION]: The example file
examples/messaging-multi-phrase.htmlcontains logic to monkey-patch theseekmethod on global objects (window.__playerandwindow.__hf). It usesObject.definePropertyto intercept method calls at runtime and inject custom rendering callbacks into the framework's core seek logic. - [EXTERNAL_DOWNLOADS]: The
scripts/package-loader.mjsscript is designed to automatically download missing dependencies from the NPM registry usingnpm installduring the initialization phase if they are not already present. - [COMMAND_EXECUTION]: The skill's developer scripts invoke shell commands. Specifically,
package-loader.mjsusesspawnSyncto executenpmfor dependency management andnodeto facilitate its process re-execution logic.
Audit Metadata