hyperframes-animation

Warn

Audited by Gen Agent Trust Hub on Nov 8, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The utility script scripts/package-loader.mjs implements a custom module loading system. It uses import() to load Node.js modules from file URLs computed at runtime. It also performs process re-execution by spawning a new Node.js instance with modified environment variables (NODE_MODULES_ENV) to inject newly installed dependencies into the process.
  • [DYNAMIC_EXECUTION]: The example file examples/messaging-multi-phrase.html contains logic to monkey-patch the seek method on global objects (window.__player and window.__hf). It uses Object.defineProperty to intercept method calls at runtime and inject custom rendering callbacks into the framework's core seek logic.
  • [EXTERNAL_DOWNLOADS]: The scripts/package-loader.mjs script is designed to automatically download missing dependencies from the NPM registry using npm install during the initialization phase if they are not already present.
  • [COMMAND_EXECUTION]: The skill's developer scripts invoke shell commands. Specifically, package-loader.mjs uses spawnSync to execute npm for dependency management and node to facilitate its process re-execution logic.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Nov 8, 2026, 07:57 AM