Security audit

hyperframes-animation

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent HyperFrames animation reference, but it includes under-pinned paths that can install or execute mutable third-party code.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T08 · Insecure Dependencies

Warning

Location: scripts/package-loader.mjs:142
Finding: Mutable HyperFrames Packages Can Be Downloaded and Executed Through the Bootstrap Fallback## Vulnerability Details **File Location**: `scripts/package-loader.mjs:142-158`, `scripts/package-loader.mjs:287-328`, and `scripts/package-loader.mjs:383-415` **Vulnerability Type**: Mutable third-party package retrieval and execution **Risk Level**: Medium ### Vulnerable Code ```js export function hyperframesPackageSpec(packageName) { const override = process.env[VERSION_OVERRIDE_ENV]?.trim(); if (override) return `${packageName}@${override}`; const version = readBundledHyperframesVersion(); if (version) return `${packageName}@${version}`; // Global skill installs have no hyperframes package.json // in their ancestor chain, so the bundled version is unknowable. Fall back to // @latest instead of throwing: already-installed packages still import, and a // bootstrap install can still proceed (@latest satisfies the pinned-spec guard). process.stderr.write( [ `hyperframes: could not determine the bundled version for ${packageName}; using @latest.`, `Set ${VERSION_OVERRIDE_ENV}=<version> to pin it.`, "", ].join("\n"), ); return `${packageName}@latest`; } ``` ```js function bootstrapWithNpmInstall(packageNames) { const installRoot = mkdtempSync(join(tmpdir(), "hyperframes-skill-deps-")); const npmArgs = [ "install", "--silent", "--no-audit", "--no-fund", "--ignore-scripts", "--no-save", "--prefix", installRoot, ...packageNames, ]; const npmCommand = resolveNpmSpawnCommand(npmArgs); if (!npmCommand) { rmSync(installRoot, { recursive: true, force: true }); throw new Error("Could not locate npm-cli.js for dependency bootstrap on Windows."); } const installResult = spawnSync(npmCommand.cmd, npmCommand.args, npmCommand.opts); if (installResult.error) throw installResult.error; if (installResult.status !== 0) { rmSync(installRoot, { recursive: true, force ...[truncated 3101 chars]
Remediation: ## Remediation Suggestions - Reject `latest`, npm distribution tags, version ranges, Git URLs, aliases, and other mutable package specifications. - Require an exact semantic version for every bootstrapped package. - Pin package integrity using a lockfile and verified npm integrity hashes. - Fail closed when the bundled version cannot be determined instead of falling back to `@latest`. - Validate `HYPERFRAMES_SKILL_PKG_VERSION` against an exact-version format before constructing a package specification. - Preserve the existing interactive confirmation, temporary installation directory, `--ignore-scripts`, and no-shell subprocess invocation. - Where feasible, distribute reviewed helper packages with the Skill or require users to install them independently through their normal locked dependency workflow.

T08 · Insecure Dependencies

Warning

Location: adapters/animate-text.md:11
Finding: External Agent Skill Installation Is Not Pinned to Reviewed Versions## Vulnerability Details **File Location**: `adapters/animate-text.md:11-14` **Vulnerability Type**: Unpinned external Skill and CLI dependency **Risk Level**: Medium ### Vulnerable Code ```bash # In your project root, install the upstream skill into .agents/skills/ npx skills add pixel-point/animate-text ``` ### Technical Analysis The documented command resolves and executes the `skills` package through `npx` without an exact package version. It then retrieves `pixel-point/animate-text` without identifying a reviewed commit SHA or immutable release. This creates two mutable supply-chain boundaries: 1. The npm package selected by `npx skills` can change after this audit. 2. The external GitHub Skill content can change because the command does not pin a commit. Agent Skills are particularly sensitive dependencies because they may contain executable utilities as well as instructions that influence Agent behavior. A future compromise or malicious update could therefore introduce local code execution or instruction-hijacking content even though the currently audited project does not contain such behavior. ### Attack Path 1. A user or Agent follows the installation instruction. 2. `npx` resolves a mutable version of the `skills` CLI. 3. The CLI downloads the current state of `pixel-point/animate-text`. 4. An attacker compromises either the npm package or the upstream repository, or publishes malicious content to the referenced moving version. 5. The downloaded Skill is installed under `.agents/skills/animate-text`. 6. The Agent loads its instructions or invokes any executable content it provides. 7. The malicious dependency acts with the permissions available to the Agent or local process. ### Impact Assessment The potential scope depends on the external Skill's contents and the capabilities of the Agent runtime. A malicious dependency could influence Agent decisions, cause unsafe tool calls, read files avail ...[truncated 359 chars]
Remediation: ## Remediation Suggestions - Pin the `skills` CLI to an exact reviewed version, for example through a locked project dependency rather than an unqualified `npx` invocation. - Pin `pixel-point/animate-text` to a reviewed commit SHA or immutable signed release. - Document the expected repository URL, commit identifier, and checksum. - Require explicit user approval before installing or loading the external Skill. - Review the external Skill's instruction files and executable scripts before use. - Prefer vendoring a legally permitted, reviewed snapshot or documenting a manual verification workflow when vendoring is not possible.

T03 · Remote Payload Retrieval and Execution

Warning

Location: adapters/lottie.md:50
Finding: Unversioned dotLottie Script Is Retrieved and Executed from a CDN## Vulnerability Details **File Location**: `adapters/lottie.md:50` **Vulnerability Type**: Remote mutable JavaScript execution **Risk Level**: Medium ### Vulnerable Code ```html <script src="https://unpkg.com/@lottiefiles/dotlottie-web"></script> ``` ### Technical Analysis The adapter recommends loading `@lottiefiles/dotlottie-web` from unpkg without an explicit package version or Subresource Integrity value. The URL therefore resolves to package content controlled by the package's current distribution tag and the CDN response at page-load time. Because the resource is JavaScript, the browser executes it in the page context. The effective code can change after this project has been audited. HTTPS protects transport confidentiality and integrity but does not protect against a compromised upstream publisher, malicious package release, CDN compromise, or unexpected tag movement. ### Attack Path 1. A user or Agent copies the adapter example into a generated animation page. 2. The page is opened for preview, capture, or rendering while network access is available. 3. The browser requests the unversioned package URL from unpkg. 4. An attacker compromises the upstream package, its release process, or the CDN response. 5. The browser receives attacker-controlled JavaScript. 6. The script executes in the generated page's origin and browser context. ### Impact Assessment Malicious CDN-delivered code could read and modify the page DOM, access data available to that origin, manipulate animation output, make network requests permitted by the browser, and interfere with the capture process. It could potentially access locally served project content exposed through the same origin. This browser script does not inherently obtain direct operating-system privileges. Its practical reach is constrained by browser sandboxing, origin policy, capture-environment configuration, and the content exposed by the local file serv ...[truncated 3 chars]
Remediation: ## Remediation Suggestions - Pin `@lottiefiles/dotlottie-web` to an exact reviewed version in the CDN URL. - Add a verified Subresource Integrity hash and `crossorigin="anonymous"`. - Prefer vendoring the reviewed JavaScript asset and serving it locally. - Apply a restrictive Content Security Policy that limits script and connection sources. - Disable external network access during deterministic rendering when remote resources are unnecessary. - Periodically review pinned third-party assets and update their hashes only after security verification.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/animation-map.test.mjs:84

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/package-loader.mjs:389

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/package-loader.test.mjs:54