hyperframes-animation

Warn

Audited by Gen Agent Trust Hub on Sep 12, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The file scripts/package-loader.mjs contains a bootstrapWithNpmInstall function that executes npm install to download packages from the public npm registry to a temporary directory. While it uses the --ignore-scripts flag as a security measure, this mechanism allows the skill to fetch and incorporate external code at runtime.
  • [DYNAMIC_EXECUTION]: After downloading packages, scripts/package-loader.mjs uses dynamic import() to load the newly installed modules from the local filesystem. Additionally, the script uses node:child_process.spawnSync to restart the current process with an altered NODE_PATH (NODE_MODULES_ENV) pointing to the temporary installation directory, which is a highly unusual execution pattern for a skill.
  • [DYNAMIC_EXECUTION]: The script scripts/animation-map.mjs leverages this loader to bring in the @hyperframes/producer package dynamically.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 12, 2026, 01:56 AM