hyperframes-animation
Warn
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The auditing tool "scripts/animation-map.mjs" utilizes a custom bootstrap mechanism ("scripts/package-loader.mjs") to programmatically resolve, install, and load Node.js dependencies at runtime. It uses dynamic "import()" statements to execute packages fetched from the network.
- [COMMAND_EXECUTION]: The skill executes external system commands using "spawnSync". Specifically, it runs "npm install" to fulfill its dependency requirements and re-invokes the Node.js process to continue its analysis after bootstrapping.
- [EXTERNAL_DOWNLOADS]: The skill is configured to automatically download packages such as "@hyperframes/producer" and "@hyperframes/core" from the public NPM registry if they are not already available in the local environment.
- [INDIRECT_PROMPT_INJECTION]: The "animation-map.mjs" script analyzes existing animation compositions by rendering them in a headless browser environment. This creates a surface for indirect prompt injection, as the tool effectively executes the JavaScript content of any composition file it is tasked to audit.
Audit Metadata