hyperframes-keyframes
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch and execute the hyperframes package from the npm registry using the npx utility.
- [COMMAND_EXECUTION]: Multiple shell commands including hyperframes check, hyperframes keyframes, and hyperframes snapshot are executed to perform linting and visual verification of compositions.
- [INDIRECT_PROMPT_INJECTION]: Ingestion points: User-provided animation subjects, pose definitions, and motion parameters are ingested from prompts during the procedure in SKILL.md. Boundary markers: The instructions lack delimiters or explicit directives to ignore potential instructions embedded within the user-supplied animation requests. Capability inventory: The skill generates JavaScript animation logic for libraries like GSAP and Anime.js and executes shell commands with user-influenced arguments. Sanitization: There is no guidance for sanitizing or escaping ingested strings before they are used in code generation or CLI command parameters.
Audit Metadata