hyperframes-audio
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/carve.mjsexecutes theffmpegCLI tool to decode audio files for analysis. This is a standard operation for the skill's primary purpose of audio processing. - [DYNAMIC_EXECUTION]: The
scripts/carve.mjsscript utilizes dynamicimport()to load modules from the@hyperframes/corepackage. The loading path is determined by the location of the composition file or a user-provided--coreargument, ensuring the tool uses the version of the library installed within the specific project context. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided HTML composition files and media assets, creating an attack surface for indirect instructions.
- Ingestion points: The
scripts/carve.mjsscript reads the content of HTML files provided via the--compargument. - Boundary markers: The script does not explicitly define boundary markers for the data it processes, though it uses regular expressions to isolate specific HTML tags and attributes.
- Capability inventory: The skill can execute shell commands via
execFileSync(specificallyffmpeg) and write modified content back to the filesystem usingwriteFileSync. - Sanitization: Data written back to the HTML file is serialized using
JSON.stringifyand attribute-escaped to prevent structural breakage of the HTML, which provides a layer of sanitization for the attributes it manages.
Audit Metadata