hyperframes
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto fetch and run thehyperframespackage and its component catalog from the npm registry. - [EXTERNAL_DOWNLOADS]: HTML examples within the skill reference well-known external libraries like GSAP from the
cdn.jsdelivr.netcontent delivery network. - [DYNAMIC_EXECUTION]: The framework's core functionality involves driving headless Chrome to execute JavaScript animations (such as GSAP, Lottie, and Three.js) to render individual video frames.
- [INDIRECT_PROMPT_INJECTION]: The skill processes HTML compositions, which represents a potential attack surface for instructions embedded in data.
- Ingestion points:
index.htmlcompositions are read and processed by therender,preview, andlintcommands. - Boundary markers: The framework relies on specific
data-*attributes to define composition structure, which helps separate data from execution logic. - Capability inventory: The skill has the ability to write files (MP4 output), execute subprocesses (
ffmpeg,npx), and run code in a browser context. - Sanitization: The tool assumes the safety of the input HTML composition provided by the agent or user for the purpose of video generation.
Audit Metadata