Most static findings are false positives from Markdown backticks, regex .exec calls, fixed relative asset paths, minified GSAP, and media-design terms. Confirmed risks are the command-driven workflow, ffmpeg subprocess use on user media, third-party CDN loads, temporary decoded audio files, unreviewed binary assets, and one low-impact Object.assign pattern. No evidence found of prompt injection text or data-exfiltration intent.
The analyzer executes ffmpeg from PATH on a user-provided media file. It avoids shell injection, but it still runs an external parser on untrusted input.
The analyzer writes a decoded temporary WAV with delete=False and removes it only after a successful read. A decode failure could leave user audio in temporary storage.
with tempfile.NamedTemporaryFile(suffix=".wav", delete=False) as tmp:
The analyzer writes a decoded temporary WAV with delete=False and removes it only after a successful read. A decode failure could leave user audio in temporary storage.
The assembled HTML imports GSAP from jsdelivr, which creates a real external runtime dependency. The presence of an integrity attribute lowers the practical risk.
SKILL.md says hyperframes init checks installed skills against GitHub and updates the global set if any are out of date. A community skill should not trigger global tool or skill updates without explicit user confirmation and pinned sources.
The workflow explicitly describes a global update side effect and provides npx, pip, Python, Node, and render commands. This is clear command-driven behavior beyond passive content generation.
var C = Object.assign({}, DEFAULT_CLIMAX, parseJSON(vars.climax, {}));
Object.assign merges parsed render variables into a fresh config object. Impact appears local to the template, but __proto__ keys could still alter that object.
04
是正措置
この監査で推奨される修正が記録されています。これらを適用する責任はメンテナーにあります。
FIX-001
高
Global update and package command workflow
Require explicit user confirmation before npx, pip, render, or any global HyperFrames skill update. Pin tool versions and document expected side effects.
FIX-002
高
ffmpeg subprocess on user media
Resolve ffmpeg from a trusted path, validate input files, add a timeout, and clean temporary files in a finally block.
FIX-003
中
Third-party script and font loading
Bundle GSAP, Three.js, and fonts locally, or add integrity attributes for every external script dependency.
FIX-004
低
Binary assets are not text-scanned
Document provenance for PNG and WOFF2 assets, keep checksums, and remove nonessential binary files from the skill package.
FIX-005
低
Prototype-sensitive object merge
Replace Object.assign on parsed render variables with a safe allowlist copy that rejects __proto__, constructor, and prototype keys.