Security audit

hyperframes-creative

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a creative-direction skill, but it includes optional tools and templates that fetch and execute third-party code or fonts without enough top-level disclosure.

Review before installing if you need offline, hermetic, or privacy-sensitive operation. Opening some bundled HTML files can contact Google Fonts or jsDelivr, and running the contrast report may install and execute npm packages after confirmation or an environment override. I did not find evidence of credential theft, data exfiltration, destructive actions, or hidden persistence.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (32)

Context-Inappropriate Capability

Low

Confidence: 92% confidence
Finding: The HTML preset fetches fonts from Google Fonts, which causes outbound network access when the file is opened. In a local creative preset, that introduces unnecessary third-party dependency, metadata leakage, and non-hermetic rendering, even though it does not directly enable code execution.

Context-Inappropriate Capability

Low

Confidence: 95% confidence
Finding: This file adds duplicate remote stylesheet loads for the same Google Fonts families, increasing the external dependency footprint and creating additional unnecessary network requests. The main risk is privacy leakage and reduced reproducibility rather than direct compromise.

Context-Inappropriate Capability

Low

Confidence: 95% confidence
Finding: This HTML showcase fetches Google Fonts from remote origins, which introduces unnecessary outbound network access and third-party dependency tracking for a local preset/demo file. In a creative-direction skill, that is not code execution, but it can leak usage metadata, reduce reproducibility, and violate offline or restricted-environment expectations.

Context-Inappropriate Capability

Low

Confidence: 97% confidence
Finding: These additional Google Fonts stylesheet links add more remote requests without functional security need for a static local showcase. The duplicate external font loading expands third-party exposure and weakens deterministic, offline-safe rendering.

Context-Inappropriate Capability

Low

Confidence: 91% confidence
Finding: The HTML imports Google Fonts from external domains, which causes network requests whenever the showcase is opened. In a local skill asset intended for creative-direction templates, this creates unnecessary third-party connectivity, leaks viewer metadata such as IP address and user agent, and weakens offline/reproducible use.

Context-Inappropriate Capability

Low

Confidence: 92% confidence
Finding: These additional stylesheet links duplicate external Google Fonts fetches, increasing unnecessary third-party network exposure. Repeated remote loads expand dependency on outside infrastructure and can introduce privacy, availability, and supply-chain concerns for what should be a self-contained static showcase.

Context-Inappropriate Capability

Low

Confidence: 88% confidence
Finding: The HTML loads Google Fonts from external domains, which creates an unnecessary outbound network dependency for what appears to be a local design showcase file. Even though this is not active code execution, it can leak access metadata, weaken offline/reproducible behavior, and expand the skill's effective network surface beyond its stated purpose.

Context-Inappropriate Capability

Low

Confidence: 89% confidence
Finding: These additional Google Fonts stylesheet imports duplicate the same pattern of unnecessary third-party network access. The duplicate imports also increase remote dependency surface and make the file less deterministic without providing security benefit.

Context-Inappropriate Capability

Low

Confidence: 93% confidence
Finding: The HTML showcase fetches external fonts from Google Fonts even though this skill is described as non-network creative-direction/design-spec content. Loading remote assets leaks user/IP/request metadata to a third party and introduces an unnecessary network dependency and supply-chain surface for a static local preset.

Context-Inappropriate Capability

Low

Confidence: 91% confidence
Finding: The file imports Google Fonts from external domains at runtime, which causes network egress and leaks viewer metadata such as IP address, user agent, and access timing to third parties. In a local creative preset whose purpose is static presentation, this external dependency is unnecessary and can violate privacy, offline-use, or hermetic-build expectations.

Context-Inappropriate Capability

Low

Confidence: 90% confidence
Finding: The document loads Google Fonts from external domains, which creates unnecessary outbound network requests for what is otherwise a static local showcase. This can leak usage metadata, weaken offline/reproducible behavior, and expand the trust boundary to third-party infrastructure without a clear functional need in the skill context.

Context-Inappropriate Capability

Low

Confidence: 95% confidence
Finding: These additional Google Fonts stylesheet imports duplicate earlier font loading and further increase third-party network exposure. While not an RCE-class issue, the extra remote dependencies raise privacy and supply-chain risk and are unnecessary for a static preset showcase.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The template imports executable JavaScript from a third-party CDN at runtime, which creates a supply-chain and integrity risk: if the CDN response is tampered with, unavailable, or serves an unexpected version, the generated caption composition will execute untrusted code. In this skill context, the file is presented as a local preset/template, so introducing remote script loading is less expected and broadens the trust boundary beyond the project repository.

Context-Inappropriate Capability

Low

Confidence: 92% confidence
Finding: This HTML file loads Google Fonts from external domains at runtime, which introduces unnecessary network access and metadata leakage for what is otherwise a local design showcase artifact. While not code-execution dangerous, it creates privacy, availability, and supply-chain dependency risks because rendering now depends on third-party resources.

Context-Inappropriate Capability

Low

Confidence: 94% confidence
Finding: These additional stylesheet links trigger more external Google Fonts requests, extending the same third-party dependency and network exposure beyond the file's core purpose as a static creative spec. The duplicate remote loading also increases fragility and broadens the external attack surface slightly.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The code will bootstrap missing packages at runtime by invoking npm, even though it adds guardrails like version pinning, interactive confirmation, a temporary install root, and --ignore-scripts. This is still dangerous because it expands the trust boundary to the npm registry and any package contents that are later imported and executed, which can enable supply-chain compromise or unexpected code execution in an environment that should not need self-installing behavior.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: This function executes npm install and then respawns the current Node process with modified environment variables pointing at the temporary node_modules tree. Even without shell injection and with lifecycle scripts disabled, this creates a self-modifying execution flow that fetches and then imports untrusted third-party code at runtime, which is especially risky for a creative-direction skill whose expected role does not justify package management or process orchestration.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The page loads GSAP from jsDelivr at runtime, which introduces an unnecessary external execution dependency for a local design-selection UI. If the CDN, network path, or dependency is compromised, untrusted script executes in the page context; it also creates avoidable outbound requests and nondeterministic behavior.

Context-Inappropriate Capability

Low

Confidence: 89% confidence
Finding: The template constructs a Google Fonts URL from TYPEPAIRS data and injects it into the document, causing runtime network access to a third party. This leaks client metadata to Google and makes rendering dependent on remote resources that are outside the skill's core local functionality.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The file loads GSAP from a third-party CDN at runtime without integrity pinning or local vendoring. If the CDN response is tampered with, unavailable, or unexpectedly changed, the page executes untrusted JavaScript in the same origin as the composition, which can compromise the rendering environment.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The file loads GSAP directly from a third-party CDN at runtime, which creates a supply-chain and availability risk. If the CDN response is tampered with, blocked, or changed, arbitrary script would execute in the composition context; in this skill, that script then has access to injected caption/group data and the global timeline object.

Missing User Warnings

Low

Confidence: 87% confidence
Finding: The page causes external font downloads without any user-facing notice, which creates an undisclosed privacy and network side effect. While low severity, this is relevant in an agent skill context because local assets are generally expected not to contact third parties implicitly.

Missing User Warnings

Low

Confidence: 83% confidence
Finding: External font retrieval occurs silently, so users or operators may not realize that opening this preset contacts third-party infrastructure. In a local creative-direction skill, undisclosed network activity is a transparency and privacy concern even if the fetched resource is only font CSS.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The file loads Google Fonts from external domains, which causes network requests to third parties when the HTML is rendered. In a local or privacy-sensitive workflow, this can leak usage metadata such as IP address, timing, and user agent without any disclosure or offline fallback.

Missing User Warnings

Low

Confidence: 92% confidence
Finding: Additional stylesheet links to Google Fonts create more third-party requests beyond the initial font imports. While not directly exploitable for code execution, these undisclosed outbound requests can violate expectations in restricted or privacy-conscious environments.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/package-loader.mjs:344

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/package-loader.test.mjs:54