hyperframes

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses npx to fetch and run the hyperframes package and its component catalog from the npm registry.
  • [EXTERNAL_DOWNLOADS]: HTML examples within the skill reference well-known external libraries like GSAP from the cdn.jsdelivr.net content delivery network.
  • [DYNAMIC_EXECUTION]: The framework's core functionality involves driving headless Chrome to execute JavaScript animations (such as GSAP, Lottie, and Three.js) to render individual video frames.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes HTML compositions, which represents a potential attack surface for instructions embedded in data.
  • Ingestion points: index.html compositions are read and processed by the render, preview, and lint commands.
  • Boundary markers: The framework relies on specific data-* attributes to define composition structure, which helps separate data from execution logic.
  • Capability inventory: The skill has the ability to write files (MP4 output), execute subprocesses (ffmpeg, npx), and run code in a browser context.
  • Sanitization: The tool assumes the safety of the input HTML composition provided by the agent or user for the purpose of video generation.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 06:20 PM