The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill features a utility (package-loader.mjs) designed to bootstrap missing framework dependencies (@hyperframes/producer, @hyperframes/core) from the official NPM registry. This mechanism is secured through defense-in-depth: it requires explicit user confirmation or environment configuration, executes installations with the --ignore-scripts flag to block malicious lifecycle scripts, and utilizes a temporary directory to keep the host project clean. All package specifications are version-pinned to prevent floating dependency risks.
[DYNAMIC_EXECUTION]: Auditing scripts like animation-map.mjs use dynamic imports to load framework components at runtime once they are confirmed as present. The package identifiers are hardcoded within the skill, and the loading logic follows standard Node.js resolution paths, ensuring predictable and safe behavior.
[INDIRECT_PROMPT_INJECTION]: The auditing tools ingest animation code (HTML/JS) from a local project directory to generate structural reports. This ingestion is the primary function of the tool—enabling agents to understand animation choreography—and does not provide a mechanism for external data to influence the agent's core instructions or access sensitive capabilities.

hyperframes-animation