hyperframes-slideshow
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to run
npx hyperframes skills update slideshowto keep the toolset current. This command fetches and executes packages from the npm registry. - [EXTERNAL_DOWNLOADS]: The
references/standalone-harness.mdfile includes an import of thethreelibrary fromcdn.jsdelivr.net, which is a well-known content delivery network used for web development. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources, such as Figma storyboard URLs and existing web pages, to automate the creation of slideshow compositions.
- Ingestion points: Figma.com URLs and source page content during conversion processes defined in
SKILL.mdandreferences/standalone-harness.md. - Boundary markers: The instructions do not define specific delimiters or "ignore instructions" warnings for the content extracted from external pages.
- Capability inventory: The skill uses the
npx hyperframesCLI for linting, validation, and serving decks, and it generates HTML and JavaScript files within the local project directory. - Sanitization: The skill documentation notes that SVG data from Figma is sanitized, but it does not specify sanitization procedures for general content captured during page conversion.
- [DYNAMIC_EXECUTION]: The skill heavily utilizes GSAP (GreenSock Animation Platform) for timeline management and Three.js for rendering 3D background effects. These libraries execute dynamically at runtime to drive the slideshow's visual states and transitions.
Audit Metadata