The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/package-loader.mjs implements a bootstrapWithNpmInstall function that automatically executes npm install to fetch missing dependencies (@hyperframes/producer and @hyperframes/core) at runtime. While it attempts to mitigate risk by using the --ignore-scripts flag and installing into a temporary directory, this mechanism facilitates the downloading and subsequent execution of external code not bundled with the skill.
[DYNAMIC_EXECUTION]: The scripts/package-loader.mjs file uses dynamic import() and require.resolve() calls on computed filesystem paths to load Node.js modules. This pattern of dynamic loading from runtime-determined paths is a security concern as it can be exploited to execute arbitrary files if the path calculation logic is compromised.
[EXTERNAL_DOWNLOADS]: The documentation in adapters/animate-text.md directs users to install an additional AI agent skill from a third-party GitHub repository (pixel-point/animate-text) using npx skills add.
[EXTERNAL_DOWNLOADS]: Multiple animation adapter files (including adapters/three.md, adapters/animejs.md, and adapters/lottie.md) instruct the agent to load established third-party animation libraries from well-known public CDNs such as jsdelivr.net, cdnjs.cloudflare.com, and unpkg.com.

hyperframes-animation