Security audit
Security checks for vulnerabilities and agentic risk
The skill provides useful visual components, but requires sending unsuccessful searches and creative requirements elsewhere without asking the user.
Make feedback optional and approve a redacted report before sending it. Before contributing, review publication contents and visibility. Use a reviewed, pinned CLI version and inspect installed source.
Rendering previews and capturing snapshots are reasonable supporting activities for visual components. However, npx hyperframes publish, explicitly labeled as publishing to hyperframes.studio, introduces an external publication capability beyond the declared component installation and catalog purpose. The snippet does not establish exactly which files are uploaded.
The substantive issue is the instruction to report every search miss using user-derived query and desired-effect text, without a consent or redaction step. If the feedback command submits these fields externally, it could disclose confidential creative requirements; the source does not provide the implementation or destination to verify the exact transmission.
Formatting components and regenerating registry/catalog files are supporting implementation details consistent with the declared purpose. However, externally publishing content and submitting repository changes introduce material capabilities not disclosed by the description. This chunk is a documented shell workflow, so these actions occur only if its commands are followed; it does not establish automatic execution.
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
| **Visual** | render and eye | renders at all, implements its description, legible, deterministic |
`hyperframes check` is not a visual gate. It passes compositions that render nothing: a blank plot
produces no error, no warning and no layout finding, because an empty render is a valid render. No
criterion below may rest on `check` alone.
### The mount harness
The catalog command invokes an unversioned npm package through npx, which can download and execute a changing release when no suitable local installation exists. This is a CLI rather than an MCP server, but a compromised package release could still execute with the agent's filesystem and credential access; the referenced plugin rules are not available here to establish mitigation.
The installation command does not constrain which HyperFrames package version npx executes if it must fetch the package. A compromised or unexpected release could execute arbitrary code with the agent's privileges, beyond the intended installation of visual components.
The feedback example also invokes HyperFrames without a version constraint, allowing npx to fetch a changing release when a local executable is unavailable. The instruction to run feedback after a search miss makes this another path to executing unreviewed package code, even during a primarily local search workflow.
The search-miss workflow directs the agent to pass the user's query and requested effect to a feedback command without explaining its network behavior or requesting permission. External submission could reveal private project details, and the nearby assurance that search sends nothing may obscure this separate reporting step; the actual feedback implementation is not supplied.
The beats command uses an unspecified HyperFrames version through npx. If npm resolution downloads a compromised release, a routine beat-analysis step could execute attacker-controlled code with the agent's permissions.
The workflow requires remote publication but does not explain which project files or assets are uploaded, who can access them, or require approval before transfer. Preview sharing is legitimate for contributions, yet a user asking for help building a block has not necessarily authorized disclosure of proprietary assets or other project content; the actual upload scope is not established by this file.
This is a CLI invocation, not an MCP server reference, but it presents a conditional dependency-integrity risk. If hyperframes is not installed locally, npx can fetch an unpinned package and execute it with the contributor's permissions; the supplied instructions do not require a locked installation first.
oxfmt is a formatting CLI, not an MCP server, but npx may download and execute an unpinned version if no local installation exists. Formatting repository files is legitimate here; the risk is executing an unreviewed dependency rather than the formatting operation itself.
Running the registry generator is appropriate for this contribution workflow, and tsx is not an MCP server. However, without a local locked installation, npx can fetch an unpinned tsx package and execute dependency code with access to the contributor's working environment.
This repeats the conditional unpinned-runtime risk for the catalog generator rather than introducing an MCP server. The local script has a legitimate purpose, but npx may first obtain and execute an unreviewed tsx release if the runtime is absent.
The manifest describes finding and installing editable visual blocks, but this workflow instructs the agent to publish content to hyperframes.studio. Publication is also required by the quality gate at L178, making an externally visible operation mandatory rather than an optional, explicitly authorized extension of local registry work.
This repeats the unpinned hyperframes execution risk, not an MCP configuration issue. Publishing may involve authenticated access, making execution of an unexpectedly downloaded package especially sensitive, although the supplied file does not establish whether a locked local dependency already exists.
The formatter check is benign, but --check does not prevent npx from fetching and executing the formatter package. This is another occurrence of the same conditional supply-chain weakness, not evidence of a malicious MCP server.
The quality gate reinforces execution of the same unpinned publishing CLI. A locked local installation would substantially reduce this concern, but no such prerequisite is established in the supplied file; this is a duplicate exposure rather than a separate attack mechanism.
The catalog command invokes an unpinned npm executable, not an MCP server. If no suitable local installation exists, npx can fetch a mutable package release and execute it with the agent's permissions; describing the catalog as non-installing does not eliminate this bootstrap execution risk.
Filtering the catalog to blocks still executes the same unpinned npm CLI. A compromised release selected by npx could execute arbitrary code with the agent's access, regardless of the nominally read-only subcommand.
The component catalog example leaves the executable's version unspecified. Where npx fetches the package, an upstream compromise or malicious release can turn this discovery step into code execution; the supplied content does not establish that any compromise has occurred.
The social-tag filter does not constrain which npm package version npx executes. The skill's recommendation to use discovery routinely increases exposure to a compromised mutable release, potentially granting it the agent's filesystem and credential access.
JSON output makes the catalog easier to parse but does not make execution of its unpinned npm CLI safe. An agent or CI job following this example may fetch and execute a compromised release with access to workspace files or CI credentials.
This unpinned CLI invocation opens a picker that immediately installs the selected item, so it is not merely a read-only discovery operation. A compromised CLI can execute arbitrary code, while the legitimate workflow also introduces downloaded source into the project.
The instructions direct the agent to install a selected item through an unpinned npm executable. This combines potential execution of a compromised CLI release with deliberate project modification, although there is no evidence of malicious author intent.
No suspicious patterns detected.