hyperframes-animation
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/package-loader.mjsutility executes shell commands usingnode:child_process.spawnSync. It specifically triggersnpm installto set up missing Node.js packages required for the skill's operation. - [DYNAMIC_EXECUTION]: The skill performs dynamic module loading using the
import()statement on file paths resolved at runtime. Additionally, it usesprocess.execPathwithspawnSyncto restart the script execution after successful dependency bootstrapping. - [REMOTE_CODE_EXECUTION]: By automating the installation of NPM packages at runtime, the skill downloads and integrates external code. The implementation mitigates common risks by using the
--ignore-scriptsflag to prevent the execution of malicious lifecycle scripts during installation. - [EXTERNAL_DOWNLOADS]: Various example files and documentation within the skill reference and load external JavaScript animation libraries from common content delivery networks like
cdn.jsdelivr.netandunpkg.com.
Audit Metadata