hyperframes-audio
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The
loadCorefunction inscripts/carve.mjsdynamically imports modules (audio-carveandaudio-fx) from the@hyperframes/corepackage. It resolves these paths relative to the project directory at runtime usingrequire.resolveandimport(). - [COMMAND_EXECUTION]: The
decodefunction inscripts/carve.mjsinvokes theffmpegbinary viaexecFileSyncto decode audio files into raw PCM data for analysis. - [INDIRECT_PROMPT_INJECTION]: The skill identifies and processes untrusted data surfaces where malicious instructions could be embedded.
- Ingestion points:
scripts/carve.mjsparses HTML files to extract media element IDs andsrcpaths, as well as mix-related attributes likedata-fx-carveanddata-fx-chain. - Boundary markers: No explicit delimiters or guardrail instructions are used to isolate parsed attribute content from the agent's control logic.
- Capability inventory: The script has the ability to execute shell commands (
ffmpeg) and write modified content back to the project's HTML files usingwriteFileSync. - Sanitization: The script performs basic JSON escaping and unescaping of attribute values but does not perform deep validation of the incoming data structures.
Audit Metadata