hyperframes
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple external sources, including GitHub PR contents, website text/assets via headless Chrome, and Figma designs.
- Ingestion points: GitHub PRs (references/routes/pr-to-video.md), website URLs (references/routes/product-launch-video.md), and Figma URLs (references/intent-interview.md).
- Boundary markers: The system uses a BRIEF.md file to transition between intent and execution phases, but lacks explicit prompt delimiters or 'ignore instructions' directives when processing external text.
- Capability inventory: The skill has broad capabilities including shell command execution (npx, gh), file writing (BRIEF.md), and network operations (hyperframes capture, hyperframes publish).
- Sanitization: Assets from Figma undergo 'SVG sanitization' and brand-token binding, but there is no evidence of sanitization for text content ingested from PRs or websites.
- [COMMAND_EXECUTION]: The skill relies on shell commands to manage its lifecycle and perform core tasks.
- Evidence: Frequent use of npx to run hyperframes CLI tools for upgrading, rendering, and updating workflow extensions (SKILL.md, references/skill-lifecycle.md).
- Evidence: Uses the GitHub CLI (gh pr view) to extract metadata from repositories (references/routes/pr-to-video.md).
- [EXTERNAL_DOWNLOADS]: The skill downloads and executes code from the NPM registry and GitHub.
- Evidence: Uses npx to fetch the hyperframes CLI and skills tool (SKILL.md, references/skill-lifecycle.md).
- Evidence: Downloads workflow-specific skills lazily from the heygen-com/hyperframes repository (references/capability-menu.md).
Audit Metadata