hyperframes-animation
Warn
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The file
scripts/package-loader.mjscontains abootstrapWithNpmInstallfunction that executesnpm installto download packages from the public npm registry to a temporary directory. While it uses the--ignore-scriptsflag as a security measure, this mechanism allows the skill to fetch and incorporate external code at runtime. - [DYNAMIC_EXECUTION]: After downloading packages,
scripts/package-loader.mjsuses dynamicimport()to load the newly installed modules from the local filesystem. Additionally, the script usesnode:child_process.spawnSyncto restart the current process with an alteredNODE_PATH(NODE_MODULES_ENV) pointing to the temporary installation directory, which is a highly unusual execution pattern for a skill. - [DYNAMIC_EXECUTION]: The script
scripts/animation-map.mjsleverages this loader to bring in the@hyperframes/producerpackage dynamically.
Audit Metadata