hyperframes-best-practices
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill consists of instructional content and utility scripts that follow best practices for the HyperFrames framework. No malicious patterns such as prompt injection, data exfiltration, or obfuscation were identified.
- [COMMAND_EXECUTION]: The skill documents the use of standard framework CLI commands (such as npx hyperframes check and npx hyperframes render) and provides local Node.js scripts (scripts/animation-map.mjs and scripts/contrast-report.mjs) to automate quality checks during the development process. These operations are within the legitimate scope of a developer-oriented tool.
- [DYNAMIC_EXECUTION]: The provided diagnostic scripts utilize Puppeteer (via the @hyperframes/producer library) to inspect the browser-based rendering of video compositions. This dynamic execution is a core architectural component used for automated contrast audits and animation metadata extraction, and no evidence of malicious payload execution was found.
- [INDIRECT_PROMPT_INJECTION]: The skill addresses the ingestion of transcription data (JSON/SRT/VTT), which is an untrusted data surface for indirect prompt injection. However, it incorporates mitigation strategies by providing explicit cleaning and validation rules for the transcript data before it is used in caption generation.
Audit Metadata