hyperframes-registry
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill identifies and fetches registry manifests and individual item files (HTML, CSS, JSON) from the
heygen-com/hyperframesrepository on GitHub. These downloads are part of the core functionality for discovering and installing reusable blocks and components. - [COMMAND_EXECUTION]: The instructions guide the user to run various CLI commands including
hyperframes add,hyperframes lint, andhyperframes preview. For contributors, it also mentions running local utility scripts such asscripts/generate-catalog-pages.tsandscripts/upload-docs-images.shto maintain the registry's documentation and visual catalog. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of third-party code snippets and compositions into a project's codebase.
- Ingestion points: The
hyperframes addcommand downloads external HTML and JS files from the registry into the localcompositions/directory. - Boundary markers: There are no explicit security boundary markers when merging component snippets into the host HTML, though the framework uses specific
data-composition-idattributes for scoping. - Capability inventory: The installed blocks and components can execute JavaScript through the GSAP and Three.js runtimes integrated into the HyperFrames engine.
- Sanitization: The workflow includes
hyperframes lintandhyperframes validatecommands to verify the structural correctness of installed items and check for runtime console errors.
Audit Metadata