The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions rely on executing the hyperframes CLI tool via npx for tasks such as project initialization (init), rendering (render), and environment checks (doctor).
[EXTERNAL_DOWNLOADS]: The use of npx hyperframes will download the hyperframes package from the public NPM registry if it is not already available in the local environment.
[PROMPT_INJECTION]: The skill exposes an attack surface for indirect prompt injection or command injection by interpolating untrusted data (such as user-provided strings for TTS or project names) into shell commands.
Ingestion points: Untrusted data enters via arguments in commands like npx hyperframes tts "Text here" and npx hyperframes init [project-name].
Boundary markers: No explicit delimiters or boundary markers (e.g., --) are used in the command templates to separate options from user-supplied positional arguments.
Capability inventory: The skill possesses the capability to execute shell commands and write to the local file system (via the init and render commands).
Sanitization: The instructions do not include specific sanitization or escaping guidelines for the agent to follow when constructing these shell commands from user input.

hyperframes-cli