hyperframes-design
Pass
Audited by Gen Agent Trust Hub on Jul 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's caption skin HTML templates (e.g.,
frame-presets/daisy-days/caption-skin.html) load the GSAP animation library from the well-knowncdn.jsdelivr.netCDN. - [REMOTE_CODE_EXECUTION]: The
scripts/package-loader.mjsfile implements a utility to install Node.js packages dynamically at runtime. It is used byscripts/contrast-report.mjsto install@hyperframes/producerandsharp. The script incorporates security best practices such as user confirmation for interactive sessions and disabling npm lifecycle scripts via the--ignore-scriptsflag. - [COMMAND_EXECUTION]: The dependency loader utilizes
child_process.spawnSyncto invokenpmfor package management and to restart the Node.js environment with the appropriate module paths. The use of array-based arguments inspawnSyncprevents command injection vulnerabilities.
Audit Metadata