hyperframes
Warn
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The script
scripts/package-loader.mjsincludes abootstrapWithNpmInstallfunction that executesnpm installto download and install Node.js packages at runtime if they are not found locally. It then proceeds to dynamicallyimport()these packages from a temporary directory. - [EXTERNAL_DOWNLOADS]: In
references/typography.md, the skill provides instructions to download font metadata fromfonts.google.comusingcurland subsequently execute a Python script (fontquery.py) on the downloaded data. - [DATA_EXFILTRATION]: The file
references/transcript-guide.mdprovides explicitcurlcommand patterns for sending local audio files to external APIs (OpenAI and Groq) for transcription. These commands use environment variables for authentication tokens ($OPENAI_API_KEY, $GROQ_API_KEY). - [COMMAND_EXECUTION]: The
references/design-picker.mdreference instructs the agent to launch a background network service usingpython3 -m http.serveron the local machine to host a design selection interface. - [COMMAND_EXECUTION]: Multiple scripts, including
scripts/package-loader.mjs, utilizenode:child_process.spawnSyncto execute shell commands such asnpm,npm.cmd, andnode.
Audit Metadata