The Agent Skills Directory

[DYNAMIC_EXECUTION]: The scripts/carve.mjs script implements dynamic loading of framework modules via the loadCore function. It resolves and imports files from the @hyperframes/core package at runtime by parsing its package.json exports. This use of computed paths for dynamic imports is a sensitive execution pattern.- [COMMAND_EXECUTION]: The skill uses execFileSync to run the ffmpeg utility for audio decoding. The command processes media files identified by their src attributes in the composition HTML. While it avoids shell injection by using argument arrays, executing external binaries on user-provided file paths is a sensitive capability.- [EXTERNAL_DOWNLOADS]: The documentation in references/diagnosis.md advises users to employ npx hyperframes normalize-audio. The use of npx involves fetching and executing code from the npm registry, which constitutes an external code dependency at runtime.- [INDIRECT_PROMPT_INJECTION]: The skill acts on user-supplied HTML files and audio assets, representing a data ingestion surface. The analysis script parses these files to derive and write back audio attributes.
Ingestion points: Composition HTML files processed by scripts/carve.mjs via the --comp parameter.
Boundary markers: None identified. The parsing logic uses regular expressions to extract media tags without implementing delimiters or instruction-filtering boundaries.
Capability inventory: The script can execute ffmpeg and perform file writes to the local project HTML.
Sanitization: The script performs basic attribute unescaping but does not include sanitization to prevent the agent from interpreting embedded instructions.

hyperframes-audio