hyperframes-core
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a multi-step agent pipeline (orchestrator -> frame packets -> sub-agents) where user-influenced data from storyboard and brief documents is translated into executable HTML and JavaScript compositions.
- Ingestion points: Untrusted data is ingested from
STORYBOARD.md,BRIEF.md, and project-level design tokens inframe.md. - Boundary markers: The dispatch mechanism uses structured markdown packets with explicit headers (e.g.,
## Project inputs,## Assigned storyboard block) to define the context for sub-agents. - Capability inventory: The skill involves writing and assembling HTML/JS files within the project directory and executing render commands via
hyperframes-cli. - Sanitization: The framework includes manual checkpoint gates (collaborative mode) and automated
npx hyperframes lintandcheckcommands that validate composition logic, timing, and security constraints (likemedia_crossorigin_breaks_preview) before final rendering. - [EXTERNAL_DOWNLOADS]: The composition templates and reference documentation recommend loading the
GSAPanimation library and theTailwind CSSbrowser runtime from thejsDelivrCDN. These are well-known and established services for delivering front-end web development resources. - [DYNAMIC_EXECUTION]: The
frame-packets-core.mjslibrary and associated workflow scripts programmatically generate composition code and agent instructions at runtime. This behavior is essential to the skill's primary purpose of building automated video renders based on text plans.
Audit Metadata