website-to-hyperframes
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill incorporates external libraries and components from JSDelivr, including GSAP (MotionPathPlugin) and the DotLottie player, which are standard tools for web-based animation and vector playback.
- [COMMAND_EXECUTION]: The workflow relies on
npxto executehyperframesandtsxfor core operations such as site capture, linting, validation, and rendering. These are functional requirements for the framework's operation. - [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests untrusted text and metadata from user-provided URLs.
- Ingestion points: Content is extracted from websites into
tokens.jsonandvisible-text.txtusing the capture command. - Boundary markers: The instructions do not explicitly mandate delimiters or 'ignore' instructions for the agent when processing the extracted text.
- Capability inventory: The agent can perform file writes, execute shell commands via
npx, and delegate tasks to sub-agents. - Sanitization: There is no documented process for sanitizing or escaping the captured web content before it is used to generate scripts or narration.
Audit Metadata