registry  /  hyper-animator  /  2.0.0

hyper-animator@2.0.0

Claude Code skill for HyperFrames animation pipeline — natural language to rendered video

AI Security Review

scanned 4d ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. The concrete risk is unconsented install-time mutation of a Claude Code skill directory. npm install automatically drops package-supplied agent instructions and helper scripts into ~/.claude/skills/hyper-animator, making them available to the user's AI-agent environment.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm install / postinstall or running hyper-animator setup
Impact
Unconsented AI-agent control-surface mutation under the user's home directory; no confirmed exfiltration or destructive behavior observed.
Mechanism
postinstall copies Claude skill files and writes .env template
Policy narrative
On install, npm executes install.js via postinstall. The script recursively copies the bundled hyper-animator Claude skill into ~/.claude/skills/hyper-animator and creates or updates a .env template there. This is not just package-local setup: it mutates an AI-agent control surface in the user's home directory without an explicit setup action, although the inspected code does not show credential exfiltration, obfuscation, or destructive behavior.
Rationale
Source inspection confirms install-time writes into ~/.claude/skills, which is an AI-agent control-surface mutation outside the package directory. Because this occurs automatically from postinstall, it meets the firewall's blocking condition for unconsented lifecycle AI-agent control-surface mutation even without network exfiltration. Product guard normalized a non-low false-positive publish_block request to warn-only suspicious.
Evidence
package.jsoninstall.jsskills/hyper-animator/SKILL.mdskills/hyper-animator/scripts/validate-quality.shskills/hyper-animator/scripts/minimax-gen.pyskills/hyper-animator/scripts/wave-gen.py~/.claude/skills/hyper-animator~/.claude/skills/hyper-animator/.env~/.claude/skills/hyper-animator/scripts/validate-quality.sh
Network endpoints3
platform.minimaxi.comapi.minimaxi.comapi.minimax.io

Decision evidence

public snapshot
AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for policy block
  • package.json runs postinstall: node install.js and exposes bin hyper-animator to install.js
  • install.js postinstall copies package skill files into ~/.claude/skills/hyper-animator
  • install.js creates/updates ~/.claude/skills/hyper-animator/.env with MiniMax config keys
  • Package ships Claude skill instructions/scripts that become active agent control surface after install
Evidence against
  • No obfuscation, eval, child_process, or dynamic remote code loading found in install.js
  • No credential harvesting/exfiltration in install.js; .env template writes empty keys and only reports configured key names
  • Network hosts in source are documented MiniMax service endpoints for package-aligned audio generation
  • Scripts appear user-invoked skill helpers for animation/audio generation, not install-time executed payloads
Behavioral surface
Source
Filesystem
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 4.92 KB of source, external domains: platform.minimaxi.com

Source & flagged code

4 flagged · loading source
package.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
install.jsView file
12Install-time AI-agent control hijack evidence: L12: const home = os.homedir(); L13: const destDir = path.join(home, '.claude', 'skills', 'hyper-animator'); L14: const srcDir = path.join(__dirname, 'skills', 'hyper-animator'); ... L38: function copyDir(src, dest) { L39: if (!fs.existsSync(dest)) fs.mkdirSync(dest, { recursive: true }); L40: for (const entry of fs.readdirSync(src, { withFileTypes: true })) { ... L43: if (entry.isDirectory()) { copyDir(s, d); } L44: else { fs.copyFileSync(s, d); if (entry.name.endsWith('.sh')) fs.chmodSync(d, 0o755); } L45: } ... L57: } L58: if (added > 0) fs.writeFileSync(envPath, content); L59: return { envPath, added }; Payload evidence from skills/hyper-animator/SKILL.md: L26: L27: Display as: `hyper-animator v<version> (commit <commit>)` in the first message to the user. Example: `hyper-animator v1.10.1 (f6b3697)`. This helps with debugging — knowing exactly... L28: ... L149: |---------|---------------| L150: | Beat JSON generated | `data: beat detection — <composition-name>` | L151: | BGM/SFX files generated | `asset: audio generated via <source>` | ... L912: - WAV format, 32kHz mono, compatible with HyperFrames `<audio>` element L913: - Exit…
Critical
Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

install.jsView on unpkg · L12
skills/hyper-animator/scripts/preview-gen.pyView file
•path = skills/hyper-animator/scripts/preview-gen.py kind = build_helper sizeBytes = 11136 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/hyper-animator/scripts/preview-gen.pyView on unpkg

Findings

1 Critical1 High3 Medium4 Low
CriticalAi Agent Control Hijackinstall.js
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumShips Build Helperskills/hyper-animator/scripts/preview-gen.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings