hyperframes-audio

Pass

Audited by Gen Agent Trust Hub on Oct 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/carve.mjs executes the ffmpeg CLI tool to decode audio files for analysis. This is a standard operation for the skill's primary purpose of audio processing.
  • [DYNAMIC_EXECUTION]: The scripts/carve.mjs script utilizes dynamic import() to load modules from the @hyperframes/core package. The loading path is determined by the location of the composition file or a user-provided --core argument, ensuring the tool uses the version of the library installed within the specific project context.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided HTML composition files and media assets, creating an attack surface for indirect instructions.
  • Ingestion points: The scripts/carve.mjs script reads the content of HTML files provided via the --comp argument.
  • Boundary markers: The script does not explicitly define boundary markers for the data it processes, though it uses regular expressions to isolate specific HTML tags and attributes.
  • Capability inventory: The skill can execute shell commands via execFileSync (specifically ffmpeg) and write modified content back to the filesystem using writeFileSync.
  • Sanitization: Data written back to the HTML file is serialized using JSON.stringify and attribute-escaped to prevent structural breakage of the HTML, which provides a layer of sanitization for the attributes it manages.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 19, 2026, 06:23 PM