hyperframes-registry

Pass

Audited by Gen Agent Trust Hub on Oct 26, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill identifies and fetches registry manifests and individual item files (HTML, CSS, JSON) from the heygen-com/hyperframes repository on GitHub. These downloads are part of the core functionality for discovering and installing reusable blocks and components.
  • [COMMAND_EXECUTION]: The instructions guide the user to run various CLI commands including hyperframes add, hyperframes lint, and hyperframes preview. For contributors, it also mentions running local utility scripts such as scripts/generate-catalog-pages.ts and scripts/upload-docs-images.sh to maintain the registry's documentation and visual catalog.
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of third-party code snippets and compositions into a project's codebase.
  • Ingestion points: The hyperframes add command downloads external HTML and JS files from the registry into the local compositions/ directory.
  • Boundary markers: There are no explicit security boundary markers when merging component snippets into the host HTML, though the framework uses specific data-composition-id attributes for scoping.
  • Capability inventory: The installed blocks and components can execute JavaScript through the GSAP and Three.js runtimes integrated into the HyperFrames engine.
  • Sanitization: The workflow includes hyperframes lint and hyperframes validate commands to verify the structural correctness of installed items and check for runtime console errors.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 26, 2026, 06:31 PM