hyperframes-audio

Pass

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The loadCore function in scripts/carve.mjs dynamically imports modules (audio-carve and audio-fx) from the @hyperframes/core package. It resolves these paths relative to the project directory at runtime using require.resolve and import().
  • [COMMAND_EXECUTION]: The decode function in scripts/carve.mjs invokes the ffmpeg binary via execFileSync to decode audio files into raw PCM data for analysis.
  • [INDIRECT_PROMPT_INJECTION]: The skill identifies and processes untrusted data surfaces where malicious instructions could be embedded.
  • Ingestion points: scripts/carve.mjs parses HTML files to extract media element IDs and src paths, as well as mix-related attributes like data-fx-carve and data-fx-chain.
  • Boundary markers: No explicit delimiters or guardrail instructions are used to isolate parsed attribute content from the agent's control logic.
  • Capability inventory: The script has the ability to execute shell commands (ffmpeg) and write modified content back to the project's HTML files using writeFileSync.
  • Sanitization: The script performs basic JSON escaping and unescaping of attribute values but does not perform deep validation of the incoming data structures.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 22, 2026, 12:14 PM