faceless-explainer

This is a local caption-generation and layout-checking CLI, with no evident malware or data exfiltration. Its generated HTML can be vulnerable to script injection when untrusted caption text contains `</script>`, and configuration paths can escape the intended project directory. The HTML command also invokes `npx hyperframes add`, which can execute package code as part of its skin-install workflow. Severity is moderate; no suspicious domains, IPs, or credential targets are present.

This script assembles an HTML media index from a JSON specification and local files. It contains no evident malware, credential theft, or data exfiltration, but untrusted specification values can cause HTML/CSS injection, and path traversal is possible through specification-controlled paths; severity is moderate when inputs are untrusted. It also loads https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js at runtime.