The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The scripts/package-loader.mjs script contains logic to automatically install Node.js packages (specifically @hyperframes/producer) from the NPM registry using the npm install command if they are not already present in the environment. While the script implements safety checks like version pinning and using the --ignore-scripts flag, this mechanism enables the runtime download and execution of external code.\n- [DYNAMIC_EXECUTION]: Following package installation, scripts/package-loader.mjs uses the dynamic import() statement to load code from paths constructed at runtime. This practice increases the risk of executing unintended or malicious modules if path resolution is manipulated.\n- [COMMAND_EXECUTION]: The scripts/package-loader.mjs utility uses node:child_process's spawnSync to execute shell commands, specifically the npm binary, to perform package installations. This exposes a command execution capability triggered during the skill's utility operations.\n- [INDIRECT_PROMPT_INJECTION]: The animation mapping tool in scripts/animation-map.mjs accepts a user-specified composition directory and renders the contained HTML/CSS files in a browser environment to extract GSAP timeline data. This presents a vulnerability surface for tool output poisoning or cross-context script execution if the analyzed compositions contain malicious code. \n
Ingestion points: The <composition-dir> argument passed to the animation-map.mjs script (processed in scripts/animation-map.mjs).\n
Boundary markers: Absent. The script evaluates functions directly within the loaded page context.\n
Capability inventory: Shell command execution via spawnSync, local file server initialization, and browser-based code evaluation.\n
Sanitization: Absent. The script runs code from the provided HTML files without filtering or escaping content.\n- [EXTERNAL_DOWNLOADS]: The documentation in adapters/animate-text.md and adapters/lottie.md references external repositories (e.g., pixel-point/animate-text) and instructs users on how to install additional third-party skills using npx skills add, which introduces external dependency risks.

hyperframes-animation