The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill makes extensive use of the npx utility to download and execute the hyperframes CLI and various workflow-specific skills from the NPM registry. Notable instances include the npx hyperframes@latest upgrade command in SKILL.md and the instructions for adding workflows via npx skills add heygen-com/hyperframes in references/skill-lifecycle.md.
[COMMAND_EXECUTION]: System commands are executed using child_process.spawnSync within scripts/plugin-cli.mjs and scripts/lib/main-module.test.mjs. The plugin-cli.mjs script acts as a specialized launcher that wraps npx and Node.js execution to manage environment variables and release versions.
[DYNAMIC_EXECUTION]: The scripts/plugin-cli.mjs script provides a mechanism to execute arbitrary Node.js scripts using a --script flag. This allows for the dynamic loading and execution of code based on paths provided during runtime.
[INDIRECT_PROMPT_INJECTION]: The skill employs a sub-agent orchestration model where "frame workers" are dispatched with prompts generated from project files (BRIEF.md, STORYBOARD.md) that incorporate user input. This creates a potential surface for indirect prompt injection, as described in references/subagent-dispatch.md and references/frame-worker-core.md.
Ingestion points: User-provided details from the "intent interview" are stored in BRIEF.md and STORYBOARD.md, which are subsequently read to form instructions for sub-agents.
Boundary markers: Content is organized using Markdown headers and YAML frontmatter, though no explicit instructions or delimiters to prevent the interpretation of data as commands by sub-agents are documented.
Capability inventory: The framework can execute shell commands via npx and manipulate the local filesystem through read and write operations.
Sanitization: While the skill mentions sanitization for Figma-derived SVG assets, it does not specify sanitization or validation for the narrative text used in sub-agent prompts.

hyperframes