The Agent Skills Directory

[DYNAMIC_EXECUTION]: The scripts/carve.mjs script performs dynamic module loading by resolving and importing @hyperframes/core at runtime via import(). The paths are computed based on the environment of the target project, which allows the skill to utilize local project dependencies but introduces dynamic execution risk.
[COMMAND_EXECUTION]: The script uses execFileSync to run the ffmpeg tool for audio decoding. The files to be processed are derived from src attributes within the input HTML files. While execFileSync is resistant to shell injection, it still involves executing external processes on user-supplied file paths.
[INDIRECT_PROMPT_INJECTION]: This skill possesses an attack surface for indirect prompt injection as it processes and edits untrusted HTML composition files.
Ingestion points: HTML composition files provided to the carving script via the --comp argument.
Boundary markers: The script uses regular expressions to extract and replace HTML tags/attributes but does not implement specific delimiters to separate data from instructions.
Capability inventory: The script has the capability to read from and write to the local file system using node:fs and to execute external commands via node:child_process.
Sanitization: The script includes functions for escaping and unescaping HTML attributes using standard entity replacement, which provides basic protection for attribute values.

hyperframes-audio