The Agent Skills Directory

[DYNAMIC_EXECUTION]: The diagnostic utility scripts/package-loader.mjs employs dynamic import() to load Node.js modules from file paths resolved at runtime. Additionally, scripts/animation-map-sampling.mjs utilizes page.evaluate() to execute JavaScript logic within a browser environment for DOM measurement and animation state sampling.
[EXTERNAL_DOWNLOADS]: The scripts/package-loader.mjs script contains logic to trigger npm install for missing dependencies, such as @hyperframes/producer and @hyperframes/core. The script implements several defensive measures, including the --ignore-scripts flag, installation into a temporary directory, and mandatory user confirmation in interactive sessions, but it remains a channel for external code acquisition.
[INDIRECT_PROMPT_INJECTION]: The scripts/animation-map.mjs script audits user-provided composition directories by reading their contents and evaluating them in a browser session. This represents an attack surface where a specially crafted malicious composition could attempt to compromise the sampling environment.
Ingestion points: scripts/animation-map.mjs (accepts an unvalidated <composition-dir> path from the user).
Boundary markers: Not present for the content ingested from the composition directory.
Capability inventory: File system access via node:fs, subprocess spawning via node:child_process, and browser-based JavaScript evaluation via page.evaluate in animation-map-sampling.mjs.
Sanitization: No evidence was found of sanitization or sandboxing of the input composition's code or structure prior to evaluation in the capture session.

hyperframes-animation