hyperframes-animation

Pass

Audited by Gen Agent Trust Hub on Sep 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/package-loader.mjs utility executes shell commands using node:child_process.spawnSync. It specifically triggers npm install to set up missing Node.js packages required for the skill's operation.
  • [DYNAMIC_EXECUTION]: The skill performs dynamic module loading using the import() statement on file paths resolved at runtime. Additionally, it uses process.execPath with spawnSync to restart the script execution after successful dependency bootstrapping.
  • [REMOTE_CODE_EXECUTION]: By automating the installation of NPM packages at runtime, the skill downloads and integrates external code. The implementation mitigates common risks by using the --ignore-scripts flag to prevent the execution of malicious lifecycle scripts during installation.
  • [EXTERNAL_DOWNLOADS]: Various example files and documentation within the skill reference and load external JavaScript animation libraries from common content delivery networks like cdn.jsdelivr.net and unpkg.com.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 26, 2026, 07:50 PM