跳转到正文
报告库
用途分类 / 其他用途

Hyperframes Animation Skill 安全审计

作者说它能做什么(原文)

All animation knowledge for HyperFrames — atomic motion rules, multi-phase scene blueprints, scene transitions, broader motion-design techniques, AND the seven runtime adapters (GSAP default, plus Lottie, Three.js, Anime.js, CSS keyframes, Web Animations API, TypeGPU). Use for any motion or animation task: pick 2-4 rules and compose, or load a blueprint, or look up runtime-specific API (e.g. GSAP

第三方安全检查结论

发现安全风险

本次检查尚未完成,以下仅展示已取得的结果。

已检查文件
121
发现的风险
15
会不会运行危险命令?检查是否下载程序后直接运行、让他人远程控制电脑,或藏起要运行的命令。发现 8 项风险
中风险

审计工具可安装并随后执行缺失的 npm 依赖

原文依据:4 处
发现了什么

当 HyperFrames 包无法解析时,加载器会确认后调用 npm 安装,并动态导入解析到的模块。即使安装禁用了生命周期脚本,导入依赖仍会执行其顶层 JavaScript。

为什么需要注意

受损、被劫持或错误版本的依赖可在运行审计工具的用户权限下读取可访问文件、使用环境凭据或修改文件。

这是实际加载路径:缺少包时会校验规格、请求确认并调用 npm 引导安装;随后解析到的模块通过动态 import 加载。禁用安装脚本只能阻止 npm 生命周期钩子,不能阻止被导入包的顶层 JavaScript。风险仅在依赖缺失且用户确认或启用显式自动确认时出现。用户可限制网络、预装并锁定已审查版本,或要求作者公布完整引导实现。

scripts/package-loader.mjs:35来自代码打开原文件
  if (missing.length > 0 && !process.env[BOOTSTRAP_ENV]) {    const npmPackages = options.npmPackages ?? missing;    assertPinnedPackageSpecs(npmPackages);    await confirmBootstrap(npmPackages);    bootstrapWithNpmInstall(npmPackages);  }
查看另外 3 个位置
scripts/package-loader.mjs:52来自代码打开原文件
  const modules = {};  for (const [packageName, entry] of entries) {    modules[packageName] = await import(pathToFileURL(entry).href);  }  return modules;
scripts/animation-map.mjs:27来自代码打开原文件
const packages = await importPackagesOrBootstrap(  ["@hyperframes/producer", "@hyperframes/core", "@hyperframes/core/compiler"],  {    npmPackages: [      hyperframesPackageSpec("@hyperframes/producer"),      hyperframesPackageSpec("@hyperframes/core"),    ],  },);const { createFileServer, createCaptureSession, closeCaptureSession, getCompositionDuration } =
scripts/package-loader.mjs:4来自代码打开原文件
//   • specs are version-pinned (assertPinnedPackageSpecs) — no floating "latest"//   • install runs `npm install --ignore-scripts` — package lifecycle scripts//     never execute//   • `--no-save` into a throwaway tmp dir — the host project is left untouched//   • requires an interactive y/N (or an explicit $HYPERFRAMES_SKILL_BOOTSTRAP_DEPS=1)//   • npm is spawned with an argv array (no shell) — never a built command string// The `installLine` strings below are DISPLAY ONLY (shown in the prompt / error
中风险

生成的作品模板会从第三方 CDN 执行 JavaScript

原文依据:4 处
发现了什么

多个适配器和示例直接通过 script 标签或模块导入加载 jsDelivr、cdnjs 和 unpkg 上的代码,且所示标签没有子资源完整性校验。dotLottie URL 甚至未指定版本。

为什么需要注意

渲染时,CDN、软件包或传输路径若被入侵,远程代码会在作品页面的浏览器上下文中执行;它也会向 CDN 暴露请求元数据,并使离线构建不可复现。

这些是供作品采用的可执行模板,而不是 Skill 自身立即加载的代码。采用后,浏览器会从 jsDelivr、cdnjs 或 unpkg 执行第三方 JavaScript;所示标签没有 SRI,dotLottie 地址也未固定版本。CDN 或解析版本变化时,作品执行的代码可能变化。用户可要求本地托管、固定精确版本并校验哈希,同时对渲染浏览器限制网络和凭据访问。

adapters/animejs.md:26来自说明文档打开原文件
```html<!-- UMD: the global `anime` is a NAMESPACE OBJECT, not a function --><script src="https://cdn.jsdelivr.net/npm/animejs@4.5.0/dist/bundles/anime.umd.min.js"></script>```
查看另外 3 个位置
adapters/lottie.md:22来自说明文档打开原文件
```html<div id="logo-lottie" class="lottie-layer"></div><script src="https://cdnjs.cloudflare.com/ajax/libs/bodymovin/5.12.2/lottie.min.js"></script><script>  const anim = lottie.loadAnimation({
adapters/lottie.md:48来自说明文档打开原文件
```html<canvas id="product-lottie" class="lottie-canvas"></canvas><script src="https://unpkg.com/@lottiefiles/dotlottie-web"></script><script>  const player = new DotLottie({
adapters/three.md:23来自说明文档打开原文件
```html<canvas id="three-layer"></canvas><script type="module">  import * as THREE from "https://cdn.jsdelivr.net/npm/three@0.181.2/+esm";  const canvas = document.getElementById("three-layer");
中风险

文本效果流程要求通过 npx 安装另一个仓库中的 Skill

原文依据:3 处
发现了什么

适配器将 Pixel Point 的外部仓库称为实现来源,并给出 npx skills add 命令。该命令需要执行 npx 工具并把外部内容安装进项目的 .agents/skills 目录。

为什么需要注意

如果 npx 包、外部仓库或其后续更新被入侵,安装过程或新 Skill 的指令可能在之后的代理会话中执行未授权操作。项目也会发生持久文件变更。

风险只适用于需要该外部目录中命名效果的场景;文档明确说明该目录并未随本 Skill 提供,并给出从项目根目录运行未固定提交或版本的 `npx skills add`。这会让 npx 工具获取外部 Skill 并把内容加入 `.agents/skills`,但所给源码不足以确认该工具的全部写入或执行行为。用户可先审查并固定仓库提交,在隔离项目中安装,或对简单效果采用文档所述的内联方案。

adapters/animate-text.md:3来自说明文档打开原文件
For deterministic text-animation specs (e.g., `typewriter` at exact `240ms / 46ms stagger / steps(1, end) easing`), this skill defers to the separate **`animate-text`** skill maintained by Pixel Point at [github.com/pixel-point/animate-text](https://github.com/pixel-point/animate-text). It provides a catalog of 24 named text effects with portable contracts and per-library implementation recipes (GSAP, Anime.js, WAAPI).**We do NOT ship the catalog inside this repo.** Pixel Point's `animate-text` is the source of truth; vendoring its files here would violate the upstream's licensing (no explicit license declared upstream as of this writing). Loading the skill separately keeps the legal picture clean while giving you the same catalog.
查看另外 2 个位置
adapters/animate-text.md:9来自说明文档打开原文件
When a beat needs a deterministic text animation, load the upstream skill alongside this one:```bash# In your project root, install the upstream skill into .agents/skills/npx skills add pixel-point/animate-text```
adapters/animate-text.md:31来自说明文档打开原文件
## When you don't need the upstream skillIf a beat's text animation is simple enough to describe in prose ("headline fades up word-by-word, 80ms stagger"), implement it inline using the GSAP knowledge already in these skills (`hyperframes-creative` → `references/motion-principles.md` and `references/beat-direction.md`; `hyperframes-animation` → `techniques.md`, entry #4 "Per-Word Kinetic Typography"). The upstream catalog is most valuable when:
中风险

无法确定配套版本时会安装可变的 npm “latest”版本

原文依据:4 处
发现了什么

全局安装场景中,如果加载器找不到随附版本,它会把依赖规格改为 `@latest`。用户确认或设置确认环境变量后,npm 会联网获取当时的最新版;`--ignore-scripts` 会阻止安装脚本,但后续重新运行辅助程序仍会使用已安装模块。

为什么需要注意

同一 Skill 在不同时间可能执行不同的第三方包代码。若最新版被攻陷、发布错误或包含不兼容变更,分析运行可能访问当前进程可访问的文件、环境变量或网络,或产生错误结果。

该风险有源码支持,但仅在依赖缺失且无法推断捆绑版本时发生:加载器会使用随时间变化的 `@latest`。交互运行要求用户明确同意;非交互运行默认拒绝,除非预先设置确认环境变量。随后它在临时目录联网执行 npm install,虽用 `--ignore-scripts` 禁用生命周期脚本,仍会重新运行当前辅助程序并加载下载的模块。因此用户可能在未固定版本的情况下执行供应链代码。可要求作者始终提供固定版本,并限制网络访问或不要设置自动确认变量。

scripts/package-loader.mjs:148来自代码打开原文件
  // Global skill installs have no hyperframes package.json  // in their ancestor chain, so the bundled version is unknowable. Fall back to  // @latest instead of throwing: already-installed packages still import, and a  // bootstrap install can still proceed (@latest satisfies the pinned-spec guard).  process.stderr.write(    [      `hyperframes: could not determine the bundled version for ${packageName}; using @latest.`,      `Set ${VERSION_OVERRIDE_ENV}=<version> to pin it.`,      "",    ].join("\n"),  );  return `${packageName}@latest`;}
查看另外 3 个位置
scripts/package-loader.mjs:296来自代码打开原文件
async function confirmBootstrap(packageSpecs) {  if (process.env[BOOTSTRAP_CONFIRM_ENV] === "1") return;  const installLine = `npm install --ignore-scripts --no-save ${packageSpecs.map(shellQuote).join(" ")}`;  if (!process.stdin.isTTY) {    throw new Error(      [        "Required helper package(s) are missing.",        "To allow a one-time temporary dependency bootstrap for this run, set:",        `  ${BOOTSTRAP_CONFIRM_ENV}=1`,        "The bootstrap command will be:",        `  ${installLine}`,      ].join("\n"),
scripts/package-loader.mjs:366来自代码打开原文件
  const args = [...process.argv.slice(1)];  const result = spawnSync(process.execPath, args, {    stdio: "inherit",    env: {      ...process.env,      [BOOTSTRAP_ENV]: "1",      [NODE_MODULES_ENV]: join(installRoot, "node_modules"),    },  });
scripts/package-loader.mjs:342来自代码打开原文件
function bootstrapWithNpmInstall(packageNames) {  const installRoot = mkdtempSync(join(tmpdir(), "hyperframes-skill-deps-"));  const installResult = spawnSync(    process.platform === "win32" ? "npm.cmd" : "npm",    [      "install",      "--silent",      "--no-audit",      "--no-fund",      "--ignore-scripts",      "--no-save",      "--prefix",      installRoot,      ...packageNames,    ],    { stdio: "inherit" },  );
中风险

示例从第三方 CDN 执行 JavaScript

原文依据:1 处
发现了什么

Lottie 示例直接从 cdnjs 加载并执行 bodymovin。该响应在合成页面的浏览器上下文中运行,同时网络请求会向 CDN 暴露连接元数据;固定版本号并不能保证下载内容已由用户审查。

为什么需要注意

若 CDN、传输路径或所引用的包内容被篡改,代码可读取或修改该页面能访问的合成内容,并可能进一步发起网络请求。

这是可运行的 HTML 示例,不只是外部文档链接:页面会从 cdnjs 获取并执行固定版本的 Lottie 脚本。使用该示例且允许网络访问时,CDN 会收到连接元数据,浏览器会信任并运行返回内容;固定版本降低漂移但没有完整性校验。用户可要求作者提供本地依赖或带 SRI 的固定资源,并限制渲染环境联网。

techniques.md:180来自说明文档打开原文件
```html<div id="logo-anim" class="lottie" style="width:500px;height:500px;"></div><script src="https://cdnjs.cloudflare.com/ajax/libs/bodymovin/5.12.2/lottie.min.js"></script><script>  window.__hfLottie = window.__hfLottie || [];  const anim = lottie.loadAnimation({    container: document.getElementById("logo-anim"),    renderer: "svg",    loop: false,    autoplay: false,    path: "../capture/assets/lottie/animation-0.json",  });  window.__hfLottie.push(anim); // REQUIRED — adapter seeks every registered instance
中风险

验证步骤使用 npx,可能临时下载并执行包

原文依据:1 处
发现了什么

Skill 要求运行 `npx hyperframes`。如果本地没有可信的固定版本,npx 可能从配置的软件源解析、下载并执行包;实际执行内容取决于当前项目依赖、锁文件、注册表和 npx 配置。

为什么需要注意

被替换或意外解析的包会以运行命令的用户权限执行,因而可能访问工作区文件、环境变量或现有凭据。

验证步骤明确要求执行两个 `npx hyperframes` 命令。若项目没有已安装且锁定的可信 CLI,npx 可能按本机配置从软件源解析、下载并执行包;所给行未限定版本或要求离线模式。风险取决于项目锁文件、注册表和 npx 配置。用户可要求作者说明可信版本与校验方式,并在隔离、禁网环境中使用已审查的本地 CLI。

adapters/animejs.md:117来自说明文档打开原文件
## ValidationAfter editing a composition that uses Anime.js:```bashnpx hyperframes lintnpx hyperframes validate```
中风险

Skill 鼓励直接复制任意网络来源的着色器代码

原文依据:2 处
发现了什么

指导允许从 ShaderToy、CodePen 或“任何地方”复制片段着色器,并宣称可改编网上找到的 GLSL。着色器虽通常受图形 API 限制,未经审查的循环、采样或高成本计算仍可耗尽 GPU/浏览器资源。

为什么需要注意

采用恶意或错误的着色器可能使预览或无头渲染崩溃、卡死或长时间占用 GPU,导致未保存工作丢失或共享渲染机器不可用。

该指南主动建议从 ShaderToy、CodePen 或“任何地方”寻找并复制 GLSL,再接入会运行它的 WebGL/GSAP 流程。着色器通常不能直接读取文件或凭据,但恶意或低质量代码可能造成高 GPU 占用、浏览器/渲染任务挂起或崩溃。风险只在用户采用未审查的外部代码时成立。用户可要求来源、许可证和性能上限,并在隔离环境中审查与测试着色器。

adapters/html-in-canvas-patterns.md:474来自说明文档打开原文件
## Creating ANY Custom EffectThe fragment shaders above are templates. The pattern is always:1. **Capture your HTML content** with `drawElementImage` (the boilerplate at the top)2. **Upload the captured canvas as a WebGL texture**3. **Write a fragment shader** that reads from the texture and outputs modified colors4. **Drive shader uniforms from GSAP** via `onUpdate`Any GLSL effect from ShaderToy, The Book of Shaders, CodePen, or anywhere else can be adapted:1. Find an effect you like (search "GLSL [effect name]" or browse shadertoy.com)2. Copy the fragment shader3. Replace `iResolution` with `vec2(1920.0, 1080.0)`, `iTime` with your `u_time` uniform4. Add `uniform sampler2D u_tex;` for the captured content texture5. Wire the uniforms to GSAP proxy values
查看另外 1 个位置
transitions/catalog.md:123来自说明文档打开原文件
## Shader TransitionsWebGL shader transitions are provided by `@hyperframes/shader-transitions` (`packages/shader-transitions/`). The package handles setup, capture, WebGL init, render loop, and GSAP integration. Read the package source for available shaders and API — do not copy raw GLSL manually.The built-ins are not a ceiling. For an effect no built-in covers, you can write custom GLSL from scratch, adapt shader code found online (ShaderToy, GLSL Sandbox, GitHub), or build a custom CSS transition that fits no existing category — combine clip-path, transforms, and filters in new ways. If the storyboard calls for an effect that doesn't exist yet, build it; the framework renders anything a browser can run.
中风险

示例会从公共 CDN 加载并执行第三方 JavaScript

原文依据:2 处
发现了什么

MotionPath 示例直接引用 jsDelivr 上的 GSAP 插件并注册执行,且没有完整性校验。复制或打开该示例会使浏览器信任 CDN 返回的代码。

为什么需要注意

浏览器会向第三方披露网络请求信息;若 CDN、包发布账户或传输链路被攻破,返回的脚本可在页面权限范围内读取或修改页面数据。

这是文档中的动画示例,不会仅因阅读技能而执行;但如果用户把该 HTML 片段复制到页面并打开,浏览器会从 jsDelivr 下载并执行 MotionPathPlugin,然后注册该插件。引用未固定完整性哈希,因此 CDN、网络路径或远端资源被替换时,代码会以页面权限运行。用户可要求作者提供本地固定版本及完整性校验,或限制成品页面的外部脚本网络访问。

techniques.md:302来自说明文档打开原文件
```html<script src="https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/MotionPathPlugin.min.js"></script><div class="dot" style="width:20px;height:20px;background:#2a8a7c;border-radius:50%;"></div><script>  gsap.registerPlugin(MotionPathPlugin);  tl.to(
查看另外 1 个位置
techniques.md:298来自说明文档打开原文件
## 9. GSAP MotionPathPluginAnimate an element along an arbitrary SVG path. Use for sliders following curves, particles along trajectories, guided reveals.
会不会泄露文件和密钥?检查是否发送含密码或密钥的文件,以及代码里是否直接写了密钥。发现 1 项风险
中风险

生成的作品可能在预览或渲染时联系公共 CDN 并执行其代码

原文依据:5 处
发现了什么

适配器和随附示例包含直接指向 jsDelivr 的浏览器脚本与 ES 模块导入。若用户照搬这些配方,打开或渲染作品会向第三方发送网络请求并执行返回的 JavaScript;版本虽固定,但没有显示子资源完整性校验。

为什么需要注意

CDN 会获知请求 IP、时间及常见 HTTP 元数据;离线或受限渲染会失败。若 CDN、发布包或传输信任链被攻陷,返回代码会在作品页面的浏览器上下文中运行,并可接触该页面能够读取的数据。

风险成立,但这些行是供作品作者复制的配方,不是技能加载时自动执行的代码。配方中的浏览器模块导入直接指向 jsDelivr;作品实际包含并在允许联网的预览或渲染环境加载这些标签时,浏览器会联系第三方并执行其返回内容。URL固定了版本,但可见标签没有 SRI 完整性属性。用户可要求本地托管经过审核的依赖、阻止渲染网络访问,或要求作者说明 CDN 信任与缓存策略。

adapters/animejs.md:76来自说明文档打开原文件
```html<script type="module">  import { animate } from "https://cdn.jsdelivr.net/npm/animejs@4.5.0/+esm";  const anim = animate(".chip", { x: "18rem", duration: 900, autoplay: false });  window.__hfAnime = window.__hfAnime || [];  window.__hfAnime.push(anim);</script>```
查看另外 4 个位置
adapters/three.md:71来自说明文档打开原文件
```html<script type="importmap">  {    "imports": {      "three": "https://cdn.jsdelivr.net/npm/three@0.181.2/build/three.module.js",      "three/addons/": "https://cdn.jsdelivr.net/npm/three@0.181.2/examples/jsm/"    }  }</script><script type="module">  import * as THREE from "three";  import { GLTFLoader } from "three/addons/loaders/GLTFLoader.js";  import { OrbitControls } from "three/addons/controls/OrbitControls.js";  // ...</script>```
examples/problem-mockup-overwhelm.html:48来自说明文档打开原文件
    <script src="https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js"></script>
adapters/html-in-canvas-patterns.md:129来自说明文档打开原文件
**Load Three.js and post-processing via ESM (use a `type="module"` script):**```html<script type="module">  import * as THREE from "https://cdn.jsdelivr.net/npm/three@0.181.2/+esm";  import { EffectComposer } from "https://cdn.jsdelivr.net/npm/three@0.181.2/examples/jsm/postprocessing/EffectComposer.js";  import { RenderPass } from "https://cdn.jsdelivr.net/npm/three@0.181.2/examples/jsm/postprocessing/RenderPass.js";  import { ShaderPass } from "https://cdn.jsdelivr.net/npm/three@0.181.2/examples/jsm/postprocessing/ShaderPass.js";  import { UnrealBloomPass } from "https://cdn.jsdelivr.net/npm/three@0.181.2/examples/jsm/postprocessing/UnrealBloomPass.js";  // ... rest of composition code using these imports</script>
examples/cta-orbit-collapse.html:62来自说明文档打开原文件
    <script src="https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js"></script>
会不会删除文件或一直在后台运行?检查是否大范围删除文件、改写磁盘,或设置自动启动。发现 1 项风险
低风险

动画映射报告会无提示覆盖目标目录中的同名文件

原文依据:3 处
发现了什么

--out 可指定任意可写目录;工具先创建该目录,然后使用 writeFile 固定写入 animation-map.json,没有所示的存在检查、备份或拒绝覆盖逻辑。

为什么需要注意

如果目标目录已有名为 animation-map.json 的用户文件,其内容会被替换。报告还会永久记录作品的绝对路径和界面几何信息。

这是实际脚本行为:`--out` 的值被解析为输出目录,目录会被创建,随后固定名称 `animation-map.json` 通过 `writeFile` 写入。源码所示路径没有存在检查或备份,因此目标目录中已有同名文件会被替换。影响限于该文件,不是整个目录。用户运行前应选择专用空目录或备份已有报告,并可要求工具默认拒绝覆盖。

scripts/animation-map.mjs:42来自代码打开原文件
const args = parseArgs(process.argv.slice(2));if (!args.composition) die("missing <composition-dir>");const FRAMES = Number(args.frames ?? 6);const OUT_DIR = resolve(args.out ?? ".hyperframes/anim-map");const MIN_DUR = Number(args["min-duration"] ?? 0.15);const WIDTH = Number(args.width ?? 1920);const HEIGHT = Number(args.height ?? 1080);const parsedFps = parseFps(args.fps ?? 30);if (!parsedFps.ok) die(`Invalid --fps "${args.fps ?? ""}": ${parsedFps.reason}`);const FPS = parsedFps.value;const COMP_DIR = resolve(args.composition);await mkdir(OUT_DIR, { recursive: true });
查看另外 2 个位置
scripts/animation-map.mjs:155来自代码打开原文件
  report.deadZones = findDeadZones(report.density, duration);  report.snapshots = await captureSnapshots(session, report.tweens, duration);  await writeFile(join(OUT_DIR, "animation-map.json"), JSON.stringify(report, null, 2));
scripts/animation-map.mjs:53来自代码打开原文件
const FPS = parsedFps.value;const COMP_DIR = resolve(args.composition);await mkdir(OUT_DIR, { recursive: true });
会不会绕过安全保护?检查是否跳过网站安全验证、开放过多文件权限,或取消操作前的确认。发现 2 项风险
中风险

WebGPU 渲染会启用标为 unsafe 的浏览器功能

原文依据:3 处
发现了什么

适配器说明渲染器自动向 Chrome 添加 --enable-unsafe-webgpu,并建议某些效果改用 Brave 或 Chrome Canary。该标志扩大了作品页面可接触的实验性 GPU 接口。

为什么需要注意

若渲染未经审核的 HTML、着色器或远程脚本,浏览器和 GPU 驱动的攻击面会增加;崩溃也可能影响同一用户会话中的浏览器状态。

在使用 WebGPU 与 HTML-as-texture 的特定效果时,文档称渲染器会自动给 Chrome 加上 `--enable-unsafe-webgpu` 和实验功能标志,并建议把可执行浏览器改为 Brave 或 Canary。作品随后可请求 GPU 适配器和设备。这是实现声明功能所需且已披露的行为,但会让作品页面接触实验性 GPU 接口;处理不受信任作品时应使用无账号、无敏感文件权限的隔离渲染环境,并仅为确实需要的作品启用。

adapters/typegpu.md:10来自说明文档打开原文件
## Render-environment prerequisite (WebGPU + html-in-canvas)The render engine auto-passes `--enable-unsafe-webgpu` and `--enable-features=CanvasDrawElement` to its Chrome launch args. Stock Chromium and the bundled headless-shell **do not** support WebGPU + `drawElementImage` together — the combo that liquid-glass blocks need (`ios26-liquid-glass`, `macos-tahoe-liquid-glass`, `liquid-glass-*`, `vfx-liquid-glass`). For those blocks, point the engine at Brave (or Chrome canary) by setting `PRODUCER_HEADLESS_SHELL_PATH` to the browser binary before running `npx hyperframes render` / `preview`. Plain TypeGPU layers without HTML-as-texture work in headless-shell — only the html-in-canvas + WebGPU combination needs the override.
查看另外 2 个位置
adapters/typegpu.md:16来自说明文档打开原文件
- Initialize WebGPU asynchronously (`await navigator.gpu.requestAdapter()`), but register all GSAP tweens **synchronously** — before any `await`. The HyperFrames player reads the timeline immediately at page load.- Render from HyperFrames time, not `performance.now()`.- Listen for the `hf-seek` event and re-render at exactly that time.- Guard against environments where WebGPU is unavailable — the adapter does not check for you.- If the composition cannot render without WebGPU, add `data-requires-webgpu` to its composition root. Local capture commands then report an actionable error instead of capturing a no-GPU fallback screen when auto-detection selects software rendering.- After submitting GPU work, register queue completion synchronously with `e.detail.waitUntil(device.queue.onSubmittedWorkDone())`. HyperFrames awaits registered work before screenshots and frame capture.
adapters/typegpu.md:30来自说明文档打开原文件
<script>  (async () => {    if (!navigator.gpu) return;    const adapter = await navigator.gpu.requestAdapter();    if (!adapter) return;    const device = await adapter.requestDevice();    const canvas = document.getElementById("gpu-layer");
低风险

安装命令没有固定依赖版本

原文依据:1 处
发现了什么

安装命令没有指定依赖版本。同样的命令以后可能下载不同代码,你实际安装的内容可能与这次检查时不同。

为什么需要注意

即使命令和报告没变,以后安装时也可能下载到另一份代码。

该行使用未带版本的 `npx hyperframes`。如果本地没有该命令,npx 可能从注册表获取当时解析到的版本,因此未来执行的代码可能变化;若项目已锁定本地依赖,则通常使用本地版本。用户可要求作者提供带版本的命令或先在锁文件中固定 CLI。

SKILL.md:84来自说明文档打开原文件
- `hyperframes-creative` — palettes, typography, narration, beat planning (non-animation creative direction)- `hyperframes-cli` — `npx hyperframes lint / check / snapshot / preview / render`
会不会误导 AI 或隐藏内容?检查工作说明是否要求 AI 忽略你的指令、干扰检查结果,或夹带看不见的文字。未发现风险
会不会偷偷改推广链接或收款方?检查是否强制替换推广链接或收款对象,同时要求隐瞒更改。发现 3 项风险
中风险

合成蓝图可把虚构的代理进度和高置信度读数呈现为真实结果

原文依据:4 处
发现了什么

蓝图明确把代理工作做成“working-state theater”,并显示检查项、严重级别和确认结果;另一规则要求置信度在 95–99 间闪动。这些读数未被要求绑定真实测量,也未要求标为演示。

为什么需要注意

若用于产品宣传、销售或决策材料,观众可能把动画生成的检查结果、完成状态或置信度当成真实系统证据,从而影响购买或信任决定。

这段证据能说明什么

来源确实提供“working-state theater”和固定在 95–99 的置信度视觉规则,若成片暗示这些是实际审计或代理结果,可能误导观看者。但上下文是动画蓝图,并明确称其为“theater”;可见行没有要求把虚构进度冒充真实运行,也没有说明这些数值用于用户决策。因此风险取决于制作者如何标注和使用。用户可要求作者区分模拟演示与实测数据,并让任何严重级别、勾选项和置信度绑定可验证来源。

这项判断针对展示的代码和适用条件,不表示风险已经实际发生。
blueprints-index.md:54来自说明文档打开原文件
<blueprint id="agent-progress-theater" roles="Key_Feature" duration="4.2–11.6s">Agent work performed as **working-state theater** — a single trigger beat (menu pick, modal click, a scan already running) hands the frame to the machine: loaders spin and status phrases swap while it visibly works, then the receipt cascades in — a checklist/findings card whose rows arrive and CHECK OFF (badge flips, strikethroughs, severity pills), or a conversation thread building message-by-message to a camera push-in on the confirmation. Reach for it to dramatize an agent doing multi-step work where the state mutation IS the demo — no typed prompt, no cursor-driven workflow, no static enumeration.</blueprint>
查看另外 3 个位置
rules/ai-tracking-box.md:123来自说明文档打开原文件
| SIZE_FREQ_MULT       | 1.5–3, non-integer | integer ratios pulse in lock-step with drift = mechanical                || CONFIDENCE_MEAN/VAR  | 95–99 / 1–3        | mean ± var ⊂ [95, 99]; < 95 "uncertain", 100 "fake-precise"; 97 is sweet || CONFIDENCE_FREQ_MULT | 3–6                | > SIZE_FREQ_MULT — label flickers faster than the box breathes           || MASCOT_SIZE          | = rendered size    | mismatch drifts the target out of the box                                |
blueprints/agent-progress-theater.md:55来自说明文档打开原文件
- slow continuous zoom into the receipt card (header drifts off top) → `multi-phase-camera` (steady-push phase) or `viewport-change`- summary card / progress pill / chat bubble / brand logo / file chip spring pop-in → `spring-pop-entrance`- summary card glides up as the findings panel expands beneath → `gsap-effects` (the glide) + `anchored-layout-expand` (the panel)- badge flip: numbered outline → solid circle + white checkmark with scale bounce → `scale-swap-transition` (outline↔solid swap at same center) + `svg-path-draw` (checkmark draw-in) + `spring-pop-entrance` (the bounce); the pending→active→complete progression itself → `dynamic-content-sequencing` (a snap state machine, per cursor-ui-demo's workflow-approve-press precedent)- strikethrough + dim on the checked label → `css-marker-patterns` (strike-through draw) + `gsap-effects` (opacity dim)- partially-drawn arc outlines animating on pending items → `svg-path-draw` (partial dashoffset, held mid-draw)- viewport scroll down the final card / internal window scroll under a static frame → `gsap-effects` (transform-only content translate inside a masked window) — use `viewport-change` only if the FRAME moves- green/red diff counters rapid tick-and-settle → `counting-dynamic-scale` (numeric proxy count-up; suppress the scale-growth component — these tick at fixed size)- dark thread card scales up from a row to dominate the frame → `card-morph-anchor` (row → full-frame morph + handoff) with the background darkening as a `gsap-effects` overlay fade
rules/ai-tracking-box.md:131来自说明文档打开原文件
- **❗ Box recomputed per-frame FROM the target** — one driver computes the target position, then the box derives from it in the same `onUpdate`. Never tween the box's position separately.- **Corner L-brackets, not a full border** — the genre signature; a full border reads as a generic UI box.- **Yellow-on-dark** — substituting another hue loses genre legibility.- **Confidence flickers in a tight band inside [95, 99]**, in a mono font.- **`pointer-events: none`** on the box — it's a decorative overlay.
中风险

品牌展示模板会直接声称 NVIDIA、Visa、ZoomInfo 和 GitHub 是受信任客户

原文依据:2 处
发现了什么

示例显示“Trusted by Leading Brands”,并在同一区域重复列出四个真实品牌名称;可见代码没有说明这些关系已经获授权或核实。

为什么需要注意

若未经替换直接发布,观众可能把模板内容理解为真实客户背书,给用户带来虚假宣传、商标或声誉风险。

模板把“Trusted by Leading Brands”与 NVIDIA、Visa、ZoomInfo、GitHub 并列展示,并重复这些名称;可见行中没有把它们标为虚构占位符或要求先验证授权。若用户直接发布模板,观众可能把它理解为真实客户或背书关系,影响商业判断并带来商标或虚假宣传风险。用户应要求作者说明品牌授权与关系依据,或在发布前限制模板使用未经核实的真实品牌名称。

examples/proof-logo-chain.html:446来自说明文档打开原文件
        >          <div class="brand-label">Trusted by Leading Brands</div>          <div class="brand-strip-window" data-layout-allow-overflow>            <div class="brand-strip-track">              <div class="brand-logo brand-nvidia" aria-label="NVIDIA"></div>              <div class="brand-logo brand-visa" aria-label="Visa"></div>              <div class="brand-logo brand-zoominfo" aria-label="ZoomInfo"></div>              <div class="brand-logo brand-github" aria-label="GitHub"></div>              <div class="brand-logo brand-nvidia" aria-label="NVIDIA"></div>              <div class="brand-logo brand-visa" aria-label="Visa"></div>              <div class="brand-logo brand-zoominfo" aria-label="ZoomInfo"></div>              <div class="brand-logo brand-github" aria-label="GitHub"></div>              <div class="brand-logo brand-nvidia" aria-label="NVIDIA"></div>              <div class="brand-logo brand-visa" aria-label="Visa"></div>              <div class="brand-logo brand-zoominfo" aria-label="ZoomInfo"></div>              <div class="brand-logo brand-github" aria-label="GitHub"></div>            </div>
查看另外 1 个位置
examples/proof-logo-chain.html:437来自说明文档打开原文件
        <!-- =====================================================             PHASE 5: BrandShowcase (label + scrolling logos)             ===================================================== -->        <div          id="phase-brands"          class="brand-strip clip"          data-start="6.3"          data-duration="1.7"          data-track-index="3"        >
中风险

审批示例按时间自动显示“Approved!”,不依赖真实批准事件

原文依据:5 处
发现了什么

时间线在固定时刻模拟按钮按压,随后直接把标签改成“Approved!”并把步骤标为完成;可见实现没有点击处理、身份校验或后端批准结果。

为什么需要注意

如果把该动画当作真实工作流界面复用,它可能向观看者错误表示文件或操作已经获得批准,并影响发布或交付决策。

这段代码的正常用途

候选所述固定时间改成“Approved!”属实,但源码把它明确实现为一个 5.5 秒、暂停且可定位的 GSAP 动画时间线:固定的“按压帧”触发视觉压缩、颜色变化、文案替换和步骤完成。可见代码没有监听真实点击,也没有调用账户、权限或后端审批接口,因此它是在演示审批动画,而非授予真实批准。若用于真实工作流,用户仍应要求界面只根据经认证的后端结果显示批准,避免把演示状态误当成授权。

这项判断针对展示的代码和适用条件,不表示风险已经实际发生。
examples/workflow-approve-press.html:493来自说明文档打开原文件
      const STEP_ACTIVE_T3 = 3.33; // step 2 → complete, step 3 → active      const BUTTON_ENTER = 3.52; // after "Render to MP4" becomes active      const PRESS_FRAME = 4.22;      const PRESS_DURATION = 0.5;      const CHECK_POP = PRESS_FRAME + PRESS_DURATION;      const SCENE_END = 5.5; // matches data-duration on the root
查看另外 4 个位置
examples/workflow-approve-press.html:555来自说明文档打开原文件
      // ── Phase 4b: Press (linear depression → linear return) ────────      // Two adjacent tweens on .btn-press — end value of (1) = start value of (2).      tl.to(".btn-press", { scale: 0.95, duration: 0.1, ease: "power1.out" }, PRESS_FRAME);      tl.to(        ".btn-press",        { scale: 1.0, duration: PRESS_DURATION - 0.1, ease: "power1.in" },        PRESS_FRAME + 0.1,      );      // ── Phase 4c: Color shift + label swap (at press end) ──────────      tl.to(        ".btn",        {          backgroundColor: "#15803d",          boxShadow: "0 0 25px rgba(21, 128, 61, 0.68)",          duration: 0.3,          ease: "power2.out",        },        CHECK_POP,      );      tl.set(".btn-label", { textContent: "Approved!" }, CHECK_POP);      tl.set(".step-3", { attr: { "data-state": "complete" } }, CHECK_POP);
examples/workflow-approve-press.html:564来自说明文档打开原文件
      // ── Phase 4c: Color shift + label swap (at press end) ──────────      tl.to(        ".btn",        {          backgroundColor: "#15803d",          boxShadow: "0 0 25px rgba(21, 128, 61, 0.68)",          duration: 0.3,          ease: "power2.out",        },        CHECK_POP,      );      tl.set(".btn-label", { textContent: "Approved!" }, CHECK_POP);      tl.set(".step-3", { attr: { "data-state": "complete" } }, CHECK_POP);
examples/workflow-approve-press.html:369来自说明文档打开原文件
  <body>    <div      id="root"      data-composition-id="interactive-workflow"      data-start="0"      data-duration="5.5"      data-width="1920"      data-height="1080"      style="position: relative; width: 1920px; height: 1080px; overflow: hidden"    >
examples/workflow-approve-press.html:481来自说明文档打开原文件
    <script>      window.__timelines = window.__timelines || {};      const tl = gsap.timeline({ paused: true });      // ── Phase boundaries (seconds) — match the blueprint ────────────      const HEADLINE_START = 0.17;      const HEADLINE_END = 0.72;      const VIDEO_START = 0.5;      const STEPS_START = 0.67;      const STEP_STAGGER = 0.5;      const STEP_ACTIVE_T2 = 2.0; // step 1 → complete, step 2 → active      const STEP_ACTIVE_T3 = 3.33; // step 2 → complete, step 3 → active      const BUTTON_ENTER = 3.52; // after "Render to MP4" becomes active      const PRESS_FRAME = 4.22;      const PRESS_DURATION = 0.5;      const CHECK_POP = PRESS_FRAME + PRESS_DURATION;      const SCENE_END = 5.5; // matches data-duration on the root

Skill 逻辑拆解

7 个说明模块

该 Skill 是 HyperFrames 动画知识库,指导代理从规则、蓝图、转场和运行时适配器中选择方案;默认组合 2–4 条规则,并使用一个暂停的 GSAP 时间线。

查看原文
SKILL.md:8来自说明文档打开原文件
All motion knowledge in one skill: **rules** (atomic recipes), **blueprints** (multi-phase scene templates), **transitions** (scene-to-scene), **techniques** (broader motion-design patterns), and **adapters** (per-runtime APIs).
SKILL.md:14来自说明文档打开原文件
Pick 2-4 rules from `rules-index.md`, glue them together with a single paused GSAP timeline, done. This is faster and produces less code than starting from a blueprint.

随附的 animation-map 工具会打包指定作品、启动本地文件服务器和浏览器捕获会话,枚举时间线动画,并把审计结果写入 animation-map.json。

查看原文
scripts/animation-map.mjs:59来自代码打开原文件
// Raw modular hosts do not mount child compositions in the capture helper.// Bundle first so duration/timeline discovery sees the same DOM as render/check.const bundle = await bundleCompositionForCapture(packages["@hyperframes/core/compiler"], COMP_DIR);let server;let session;try {  server = await createFileServer({    projectDir: COMP_DIR,    compiledDir: bundle.compiledDir,    port: 0,  });  // Canonical transient-init retry/cleanup (mirrors the render pipeline's
scripts/animation-map.mjs:87来自代码打开原文件
  const duration = await getCompositionDuration(session);  const tweens = await enumerateTweens(session);  const kept = tweens.filter((tw) => tw.end - tw.start >= MIN_DUR);
scripts/animation-map.mjs:155来自代码打开原文件
  report.deadZones = findDeadZones(report.density, duration);  report.snapshots = await captureSnapshots(session, report.tweens, duration);  await writeFile(join(OUT_DIR, "animation-map.json"), JSON.stringify(report, null, 2));

生成的动画映射包含作品的绝对路径,以及页面中带 ID 元素的位置、尺寸和透明度。这些信息按所示代码保存在本地报告中,可能暴露项目结构或界面布局给之后读取该报告的人。

查看原文
scripts/animation-map.mjs:91来自代码打开原文件
  const report = {    composition: COMP_DIR,    duration,    totalTweens: tweens.length,    mappedTweens: kept.length,    skippedMicroTweens: tweens.length - kept.length,    tweens: [],  };
scripts/animation-map.mjs:576来自代码打开原文件
    await seekTo(session, t);    const visible = await session.page.evaluate(() => {      const out = [];      const els = document.querySelectorAll("[id]");      for (const el of els) {        const cs = getComputedStyle(el);        if (cs.display === "none") continue;        const opacity = parseFloat(cs.opacity);        if (opacity < 0.01) continue;        const rect = el.getBoundingClientRect();        if (rect.width < 1 || rect.height < 1) continue;        out.push({          id: el.id,          x: Math.round(rect.x),          y: Math.round(rect.y),          w: Math.round(rect.width),          h: Math.round(rect.height),          opacity: +opacity.toFixed(2),        });      }

规则要求动画可回放定位且确定性执行,禁止未播种随机数、墙钟时间、无限重复和布局属性补间。这些约束降低渲染差异,但不限制依赖安装或远程脚本加载。

查看原文
rules-index.md:9来自说明文档打开原文件
- runs on ONE **paused** GSAP timeline registered on `window.__timelines` (never autoplay, never a second timeline);- is **seek-safe both directions**: `fromTo` with explicit from-states (t=0 correct under seek; `immediateRender: false` when re-owning a target), absolute values — never relative `+=` tweens; state readable as a pure function of timeline time, no mutable trackers;- is **deterministic**: no `Math.random()`, no `Date.now()` — index-derived pseudo-random and baked schedules only; finite repeats, never `repeat: -1`;- animates **transforms and paint-only properties** — `width`/`height`/`top`/`left` tweens are forbidden (use scale/translate proxies, masks, or `anchored-layout-expand`);- caps group staggers so an arrival reads as one beat (`items × stagger ≤ ~0.5s`);- puts **no CSS `transition`** on animated elements (they interpolate independently of seek and flicker) and hints compositors with `will-change: transform` where many tweens run at once;- measures DOM (`offsetHeight`, `getBoundingClientRect`) at build time only in a **single-scene** composition — in a multi-scene montage, later clips may not be laid out yet: use authored CSS-matched constants;- lives inside a standard scene clip per `hyperframes-core` (`class="clip"` + `data-*` timing) — rule snippets show mechanism DOM only, not the scene scaffold.

该 Skill 主要提供 HyperFrames 动画规则、蓝图、转场和运行时适配器,并将现有作品的分析任务路由到一个脚本。

查看原文
SKILL.md:8来自说明文档打开原文件
All motion knowledge in one skill: **rules** (atomic recipes), **blueprints** (multi-phase scene templates), **transitions** (scene-to-scene), **techniques** (broader motion-design patterns), and **adapters** (per-runtime APIs).For the composition contract (data attributes, sub-compositions, determinism) see `hyperframes-core`.
SKILL.md:31来自说明文档打开原文件
| Read one blueprint's full recipe                                               | `blueprints/<id>.md`                                || Author a scene transition (CSS-driven, between two clips)                      | `transitions/overview.md`, `transitions/catalog.md` || Look up a broader motion-design technique                                      | `techniques.md`                                     || Analyze an existing composition's animation map                                | `scripts/animation-map.mjs`                         || GSAP API — timeline / tweens / position parameters                             | `adapters/gsap.md`                                  || GSAP — drop-in effect recipes                                                  | `rules/gsap-effects.md`                             |

缺少辅助包时,加载器会显示将执行的 npm 命令,并要求终端确认;非交互环境需显式设置确认变量。安装禁用生命周期脚本并放在新建的临时目录中,运行结束后删除该目录。

查看原文
scripts/package-loader.mjs:296来自代码打开原文件
async function confirmBootstrap(packageSpecs) {  if (process.env[BOOTSTRAP_CONFIRM_ENV] === "1") return;  const installLine = `npm install --ignore-scripts --no-save ${packageSpecs.map(shellQuote).join(" ")}`;  if (!process.stdin.isTTY) {    throw new Error(      [        "Required helper package(s) are missing.",        "To allow a one-time temporary dependency bootstrap for this run, set:",        `  ${BOOTSTRAP_CONFIRM_ENV}=1`,        "The bootstrap command will be:",        `  ${installLine}`,      ].join("\n"),    );  }  const rl = createInterface({ input: process.stdin, output: process.stderr });  try {    const answer = await rl.question(      [        "HyperFrames helper package(s) are missing.",        `Run a temporary install with lifecycle scripts disabled?`,        `  ${installLine}`,        "Proceed? [y/N] ",      ].join("\n"),
scripts/package-loader.mjs:342来自代码打开原文件
function bootstrapWithNpmInstall(packageNames) {  const installRoot = mkdtempSync(join(tmpdir(), "hyperframes-skill-deps-"));  const installResult = spawnSync(    process.platform === "win32" ? "npm.cmd" : "npm",    [      "install",      "--silent",      "--no-audit",      "--no-fund",      "--ignore-scripts",      "--no-save",      "--prefix",      installRoot,      ...packageNames,    ],    { stdio: "inherit" },  );  if (installResult.error) throw installResult.error;  if (installResult.status !== 0) {    rmSync(installRoot, { recursive: true, force: true });    process.exit(installResult.status ?? 1);  }  const args = [...process.argv.slice(1)];  const result = spawnSync(process.execPath, args, {    stdio: "inherit",    env: {      ...process.env,      [BOOTSTRAP_ENV]: "1",      [NODE_MODULES_ENV]: join(installRoot, "node_modules"),    },  });  rmSync(installRoot, { recursive: true, force: true });  if (result.error) throw result.error;

部分适配器和示例让生成的 HTML 在浏览器中直接从 jsDelivr 获取并执行固定版本的 Anime.js、Three.js 或 GSAP。

查看原文
adapters/animejs.md:76来自说明文档打开原文件
```html<script type="module">  import { animate } from "https://cdn.jsdelivr.net/npm/animejs@4.5.0/+esm";  const anim = animate(".chip", { x: "18rem", duration: 900, autoplay: false });
adapters/html-in-canvas-patterns.md:129来自说明文档打开原文件
**Load Three.js and post-processing via ESM (use a `type="module"` script):**```html<script type="module">  import * as THREE from "https://cdn.jsdelivr.net/npm/three@0.181.2/+esm";  import { EffectComposer } from "https://cdn.jsdelivr.net/npm/three@0.181.2/examples/jsm/postprocessing/EffectComposer.js";  import { RenderPass } from "https://cdn.jsdelivr.net/npm/three@0.181.2/examples/jsm/postprocessing/RenderPass.js";  import { ShaderPass } from "https://cdn.jsdelivr.net/npm/three@0.181.2/examples/jsm/postprocessing/ShaderPass.js";  import { UnrealBloomPass } from "https://cdn.jsdelivr.net/npm/three@0.181.2/examples/jsm/postprocessing/UnrealBloomPass.js";  // ... rest of composition code using these imports</script>
examples/cta-orbit-collapse.html:62来自说明文档打开原文件
    <script src="https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js"></script>

该 Skill 是 HyperFrames 的动画知识库,指导代理从规则、场景蓝图、转场和运行时适配器中选择方案;默认将 2–4 条规则组合到一个暂停的 GSAP 时间线中。

查看原文
SKILL.md:8来自说明文档打开原文件
All motion knowledge in one skill: **rules** (atomic recipes), **blueprints** (multi-phase scene templates), **transitions** (scene-to-scene), **techniques** (broader motion-design patterns), and **adapters** (per-runtime APIs).For the composition contract (data attributes, sub-compositions, determinism) see `hyperframes-core`.## Default: compose atomic rulesPick 2-4 rules from `rules-index.md`, glue them together with a single paused GSAP timeline, done. This is faster and produces less code than starting from a blueprint.

提供的示例会在浏览器页面中直接创建 DOM、测量布局并注册可由 HyperFrames 定位时间的全局时间线;这些是可运行实现,不只是视觉说明。

查看原文
examples/brand-reveal-assemble-zoom.html:244来自说明文档打开原文件
         ================================================================ */      window.__timelines = window.__timelines || {};      const tl = gsap.timeline({ paused: true });      window.__timelines["main"] = tl;      {        /* Measure the brand text width with a hidden DOM probe. */        const probe = document.createElement("span");        probe.className = "measure-probe";        probe.style.font = `700 ${BRAND_FONT_SIZE}px "Google Sans", "Roboto", Inter, system-ui, sans-serif`;        probe.style.whiteSpace = "pre";        probe.style.lineHeight = "1";        probe.textContent = "Hyperframes"; // MUST match the rendered .brand-text casing        document.body.appendChild(probe);        const brandTextWidth = probe.getBoundingClientRect().width;        probe.remove();

Skill 强调确定性渲染,例如禁止随机数、独立的 requestAnimationFrame 和墙钟时间,并要求 GPU 工作完成后再结束事件处理。

查看原文
adapters/typegpu.md:177来自说明文档打开原文件
## Deterministic Rendering- No `Math.random()` — use a seeded PRNG.- Do not use an autonomous `requestAnimationFrame` simulation loop. Render in response to `hf-seek`; HyperFrames owns the paused-presentation heartbeat and may re-present the same time.- No `performance.now()` for animation time — read `window.__hfTypegpuTime` or `e.detail.time`.- Register GPU completion with `e.detail.waitUntil(device.queue.onSubmittedWorkDone())` before the event listener returns.

除创作指导外,Skill 还指示运行两个项目命令来检查 Anime.js 合成。

查看原文
adapters/animejs.md:117来自说明文档打开原文件
## ValidationAfter editing a composition that uses Anime.js:```bashnpx hyperframes lintnpx hyperframes validate```

该 Skill 声称用于 HyperFrames 动效创作,并默认让代理从规则索引选择 2–4 个规则,组合成一个暂停的 GSAP 时间线。

查看原文
SKILL.md:2来自说明文档打开原文件
---name: hyperframes-animationdescription: "All animation knowledge for HyperFrames — atomic motion rules, multi-phase scene blueprints, scene transitions, broader motion-design techniques, AND the seven runtime adapters (GSAP default, plus Lottie, Three.js, Anime.js, CSS keyframes, Web Animations API, TypeGPU). Use for any motion or animation task: pick 2-4 rules and compose, or load a blueprint, or look up runtime-specific API (e.g. GSAP eases / Lottie player / Three.js mixer). Also covers auditing an existing composition's choreography (animation map) and 24 named text-animation effects. HyperFrames-native: single paused timeline, seek-safe, deterministic."---
SKILL.md:12来自说明文档打开原文件
## Default: compose atomic rulesPick 2-4 rules from `rules-index.md`, glue them together with a single paused GSAP timeline, done. This is faster and produces less code than starting from a blueprint.
从这里开始 · 工作说明SKILL.md
hyperframes-animation
连线表示工作说明包含的模块,不是实际运行顺序。点击模块可查看原文。

文件引用关系图

40 处引用
哪些文件发起引用引用了什么
连线表示真实的文件引用,不是运行顺序。点击节点可高亮相关连线,并查看具体文件和原文位置。虚线表示还有文件需要定位。
文件与检查记录121 个文件

检查范围与遗漏

  • 有检测结果未通过证据校验或未完成处理,本报告不能代表完整检查。
逐文件查看涉及的内容

下方列出本次涉及的原文范围;纳入检查不代表已查清所有问题。

  • SKILL.md已纳入全文
  • scripts/animation-map-sampling.mjs已纳入全文
  • scripts/animation-map-sampling.test.mjs已纳入全文
  • scripts/animation-map.mjs已纳入全文
  • scripts/animation-map.test.mjs已纳入全文
  • scripts/package-loader.mjs已纳入全文
  • scripts/package-loader.test.mjs已纳入全文
  • rules/3d-camera-flight.md已纳入全文
  • rules/3d-page-scroll.md已纳入全文
  • rules/3d-text-depth-layers.md已纳入全文
  • rules/ambient-glow-bloom.md已纳入全文
  • rules/anchored-layout-expand.md已纳入全文
  • rules/asr-keyword-glow.md已纳入全文
  • rules/camera-cursor-tracking.md已纳入全文
  • rules/card-morph-anchor.md已纳入全文
  • rules/center-outward-expansion.md已纳入全文
  • rules/context-sensitive-cursor.md已纳入全文
  • rules/coordinate-target-zoom.md已纳入全文
  • rules/counting-dynamic-scale.md已纳入全文
  • rules/css-marker-patterns.md已纳入全文
  • rules/cursor-click-ripple.md已纳入全文
  • rules/cursor-drag.md已纳入全文
  • rules/depth-of-field-blur.md已纳入全文
  • rules/depth-scatter-assemble.md已纳入全文
  • rules/discrete-text-sequence.md已纳入全文
  • rules/dynamic-content-sequencing.md已纳入全文
  • rules/hacker-flip-3d.md已纳入全文
  • rules/motion-blur-streak.md已纳入全文
  • rules/multi-cursor-choreography.md已纳入全文
  • rules/multi-phase-camera.md已纳入全文
  • rules/nudge-curve.md已纳入全文
  • rules/orbit-3d-entry.md已纳入全文
  • rules/physics-press-reaction.md已纳入全文
  • rules/press-release-spring.md已纳入全文
  • rules/reactive-displacement.md已纳入全文
  • rules/scale-swap-transition.md已纳入全文
  • rules/sine-wave-loop.md已纳入全文
  • rules/spring-pop-entrance.md已纳入全文
  • rules/stat-bars-and-fills.md已纳入全文
  • rules/svg-path-draw.md已纳入全文
  • rules/theme-crossfade-morph.md已纳入全文
  • rules/viewport-change.md已纳入全文
  • rules/waterfall-entry.md已纳入全文
  • adapters/animate-text.md已纳入全文
  • adapters/animejs.md已纳入全文
  • adapters/css-animations.md已纳入全文
  • adapters/gsap-easing-and-stagger.md已纳入全文
  • adapters/gsap-timeline-and-labels.md已纳入全文
  • adapters/gsap-transforms-and-perf.md已纳入全文
  • adapters/gsap.md已纳入全文
  • adapters/html-in-canvas-patterns.md已纳入全文
  • adapters/lottie.md已纳入全文
  • adapters/three.md已纳入全文
  • adapters/typegpu.md已纳入全文
  • adapters/waapi.md已纳入全文
  • blueprints-index.md已纳入全文
  • blueprints/agent-progress-theater.md已纳入全文
  • blueprints/camera-journey.md已纳入全文
  • blueprints/comparison-split.md已纳入全文
  • blueprints/constellation-hub.md已纳入全文
  • blueprints/cta-morph-press.md已纳入全文
  • blueprints/cursor-ui-demo.md已纳入全文
  • blueprints/dataviz-countup.md已纳入全文
  • blueprints/device-surface-showcase.md已纳入全文
  • blueprints/fixed-anchor-cycle.md已纳入全文
  • blueprints/grid-card-assemble.md已纳入全文
  • blueprints/kinetic-type-beats.md已纳入全文
  • blueprints/logo-assemble-lockup.md已纳入全文
  • blueprints/overwhelm-surround.md已纳入全文
  • blueprints/panel-edit-live-sync.md已纳入全文
  • blueprints/prompt-type-submit-generate.md已纳入全文
  • blueprints/spatial-pan-stations.md已纳入全文
  • blueprints/ticker-takeover.md已纳入全文
  • blueprints/titlecard-reveal.md已纳入全文
  • blueprints/transcript-scroll-artifact-reveal.md已纳入全文
  • blueprints/typewriter-reveal.md已纳入全文
  • blueprints/video-text-pivot.md已纳入全文
  • blueprints/zoom-out-workspace-reveal.md已纳入全文
  • examples/brand-reveal-assemble-zoom.html已纳入全文
  • examples/comparison-split-cards.html已纳入全文
  • examples/concept-demo-decode-pan.html已纳入全文
  • examples/cta-morph-press.html已纳入全文
  • examples/cta-orbit-collapse.html已纳入全文
  • examples/demo-page-scroll-spotlight.html已纳入全文
  • examples/hook-counter-burst.html已纳入全文
  • examples/messaging-multi-phrase.html已纳入全文
  • examples/metric-video-text-pivot.html已纳入全文
  • examples/problem-mockup-overwhelm.html已纳入全文
  • examples/proof-logo-chain.html已纳入全文
  • examples/takeover-ticker-displace.html已纳入全文
  • examples/workflow-approve-press.html已纳入全文
  • rules-index.md已纳入全文
  • rules/ai-tracking-box.md已纳入全文
  • rules/avatar-cloud-network.md已纳入全文
  • rules/chart-scrub-readout.md已纳入全文
  • rules/chromatic-glitch.md已纳入全文
  • rules/control-target-sync.md已纳入全文
  • rules/gradient-text-sweep.md已纳入全文
  • rules/gsap-effects.md已纳入全文
  • rules/kinetic-beat-slam.md已纳入全文
  • rules/particle-burst.md已纳入全文
  • rules/split-tilt-cards.md已纳入全文
  • rules/svg-icon-enrichment.md已纳入全文
  • rules/vertical-spring-ticker.md已纳入全文
  • techniques.md已纳入全文
  • transitions/catalog.md已纳入全文
  • transitions/css-3d.md已纳入全文
  • transitions/css-blur.md已纳入全文
  • transitions/css-cover.md已纳入全文
  • transitions/css-destruction.md已纳入全文
  • transitions/css-dissolve.md已纳入全文
  • transitions/css-distortion.md已纳入全文
  • transitions/css-grid.md已纳入全文
  • transitions/css-light.md已纳入全文
  • transitions/css-mechanical.md已纳入全文
  • transitions/css-other.md已纳入全文
  • transitions/css-push.md已纳入全文
  • transitions/css-radial.md已纳入全文
  • transitions/css-scale.md已纳入全文
  • transitions/overview.md已纳入全文
  • transitions/TRANSITION-REGISTRY.md已纳入全文

这份报告只针对上方版本。我们看了拿到的代码和说明文件,没有实际运行 Skill,也没有检查它另外安装的软件包。因此,这不是“保证安全”的承诺;换了版本或使用环境,结果也可能不同。

  • SKILL.md工作说明
  • adapters/animate-text.md配套文件
  • adapters/animejs.md配套文件
  • adapters/css-animations.md配套文件
  • adapters/gsap-easing-and-stagger.md配套文件
  • adapters/gsap-timeline-and-labels.md配套文件
  • adapters/gsap-transforms-and-perf.md配套文件
  • adapters/gsap.md配套文件
  • adapters/html-in-canvas-patterns.md配套文件
  • adapters/lottie.md配套文件
  • adapters/three.md配套文件
  • adapters/typegpu.md配套文件
  • adapters/waapi.md配套文件
  • blueprints-index.md配套文件
  • blueprints/agent-progress-theater.md配套文件
  • blueprints/camera-journey.md配套文件
  • blueprints/comparison-split.md配套文件
  • blueprints/constellation-hub.md配套文件
  • blueprints/cta-morph-press.md配套文件
  • blueprints/cursor-ui-demo.md配套文件
  • blueprints/dataviz-countup.md配套文件
  • blueprints/device-surface-showcase.md配套文件
  • blueprints/fixed-anchor-cycle.md配套文件
  • blueprints/grid-card-assemble.md配套文件
  • blueprints/kinetic-type-beats.md配套文件
  • blueprints/logo-assemble-lockup.md配套文件
  • blueprints/overwhelm-surround.md配套文件
  • blueprints/panel-edit-live-sync.md配套文件
  • blueprints/prompt-type-submit-generate.md配套文件
  • blueprints/spatial-pan-stations.md配套文件
  • blueprints/ticker-takeover.md配套文件
  • blueprints/titlecard-reveal.md配套文件
  • blueprints/transcript-scroll-artifact-reveal.md配套文件
  • blueprints/typewriter-reveal.md配套文件
  • blueprints/video-text-pivot.md配套文件
  • blueprints/zoom-out-workspace-reveal.md配套文件
  • examples/brand-reveal-assemble-zoom.html配套文件
  • examples/comparison-split-cards.html配套文件
  • examples/concept-demo-decode-pan.html配套文件
  • examples/cta-morph-press.html配套文件
  • examples/cta-orbit-collapse.html配套文件
  • examples/demo-page-scroll-spotlight.html配套文件
  • examples/hook-counter-burst.html配套文件
  • examples/messaging-multi-phrase.html配套文件
  • examples/metric-video-text-pivot.html配套文件
  • examples/problem-mockup-overwhelm.html配套文件
  • examples/proof-logo-chain.html配套文件
  • examples/takeover-ticker-displace.html配套文件
  • examples/workflow-approve-press.html配套文件
  • rules-index.md配套文件
  • rules/3d-camera-flight.md配套文件
  • rules/3d-page-scroll.md配套文件
  • rules/3d-text-depth-layers.md配套文件
  • rules/ai-tracking-box.md配套文件
  • rules/ambient-glow-bloom.md配套文件
  • rules/anchored-layout-expand.md配套文件
  • rules/asr-keyword-glow.md配套文件
  • rules/avatar-cloud-network.md配套文件
  • rules/camera-cursor-tracking.md配套文件
  • rules/card-morph-anchor.md配套文件
  • rules/center-outward-expansion.md配套文件
  • rules/chart-scrub-readout.md配套文件
  • rules/chromatic-glitch.md配套文件
  • rules/context-sensitive-cursor.md配套文件
  • rules/control-target-sync.md配套文件
  • rules/coordinate-target-zoom.md配套文件
  • rules/counting-dynamic-scale.md配套文件
  • rules/css-marker-patterns.md配套文件
  • rules/cursor-click-ripple.md配套文件
  • rules/cursor-drag.md配套文件
  • rules/depth-of-field-blur.md配套文件
  • rules/depth-scatter-assemble.md配套文件
  • rules/discrete-text-sequence.md配套文件
  • rules/dynamic-content-sequencing.md配套文件
  • rules/gradient-text-sweep.md配套文件
  • rules/gsap-effects.md配套文件
  • rules/hacker-flip-3d.md配套文件
  • rules/kinetic-beat-slam.md配套文件
  • rules/motion-blur-streak.md配套文件
  • rules/multi-cursor-choreography.md配套文件
  • rules/multi-phase-camera.md配套文件
  • rules/nudge-curve.md配套文件
  • rules/orbit-3d-entry.md配套文件
  • rules/particle-burst.md配套文件
  • rules/physics-press-reaction.md配套文件
  • rules/press-release-spring.md配套文件
  • rules/reactive-displacement.md配套文件
  • rules/scale-swap-transition.md配套文件
  • rules/sine-wave-loop.md配套文件
  • rules/split-tilt-cards.md配套文件
  • rules/spring-pop-entrance.md配套文件
  • rules/stat-bars-and-fills.md配套文件
  • rules/svg-icon-enrichment.md配套文件
  • rules/svg-path-draw.md配套文件
  • rules/theme-crossfade-morph.md配套文件
  • rules/vertical-spring-ticker.md配套文件
  • rules/viewport-change.md配套文件
  • rules/waterfall-entry.md配套文件
  • scripts/animation-map-sampling.mjs脚本
  • scripts/animation-map-sampling.test.mjs脚本
  • scripts/animation-map.mjs脚本
  • scripts/animation-map.test.mjs脚本
  • scripts/package-loader.mjs脚本
  • scripts/package-loader.test.mjs脚本
  • techniques.md配套文件
  • transitions/TRANSITION-REGISTRY.md配套文件
  • transitions/catalog.md配套文件
  • transitions/css-3d.md配套文件
  • transitions/css-blur.md配套文件
  • transitions/css-cover.md配套文件
  • transitions/css-destruction.md配套文件
  • transitions/css-dissolve.md配套文件
  • transitions/css-distortion.md配套文件
  • transitions/css-grid.md配套文件
  • transitions/css-light.md配套文件
  • transitions/css-mechanical.md配套文件
  • transitions/css-other.md配套文件
  • transitions/css-push.md配套文件
  • transitions/css-radial.md配套文件
  • transitions/css-scale.md配套文件
  • transitions/overview.md配套文件

代码和说明中提到的操作

运行命令
scripts/animation-map.test.mjs:2来自代码打开原文件
import assert from "node:assert/strict";import { spawnSync } from "node:child_process";import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
scripts/package-loader.mjs:11来自代码打开原文件
// text); they are never handed to a shell or executed.import { spawnSync } from "node:child_process";import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
scripts/package-loader.test.mjs:3来自代码打开原文件
import assert from "node:assert/strict";import { spawnSync } from "node:child_process";import { copyFileSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
安装其他软件包
scripts/package-loader.mjs:4来自代码打开原文件
//   • specs are version-pinned (assertPinnedPackageSpecs) — no floating "latest"//   • install runs `npm install --ignore-scripts` — package lifecycle scripts//     never execute
scripts/package-loader.mjs:47来自代码打开原文件
        "Install them in this project, for example:",        `  npm install --save-dev ${packageNames.map(shellQuote).join(" ")}`,      ].join("\n"),
scripts/package-loader.mjs:299来自代码打开原文件
  const installLine = `npm install --ignore-scripts --no-save ${packageSpecs.map(shellQuote).join(" ")}`;  if (!process.stdin.isTTY) {
连接外部网站
scripts/animation-map.test.mjs:41来自代码打开原文件
          "  }",          '  return { url: "http://test", close() {} };',          "}",
scripts/animation-map.test.mjs:194来自代码打开原文件
const FAKE_PRODUCER_COMMON = [  'export async function createFileServer() { return { url: "http://test", close() {} }; }',  'export async function createCaptureSession() { console.error("SESSION_CREATED"); return {}; }',
scripts/animation-map.test.mjs:339来自代码打开原文件
  "});",  'export async function createFileServer() { return { url: "http://test", close() {} }; }',  "export async function createCaptureSession() {",
读取文件
scripts/animation-map.test.mjs:3来自代码打开原文件
import { spawnSync } from "node:child_process";import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";import { tmpdir } from "node:os";
scripts/animation-map.test.mjs:34来自代码打开原文件
        [          'import { readFileSync } from "node:fs";',          'import { join } from "node:path";',
scripts/animation-map.test.mjs:37来自代码打开原文件
          "export async function createFileServer(options) {",          '  const bundled = readFileSync(join(options.compiledDir, "index.html"), "utf8");',          '  if (bundled !== "<!doctype html><main>bundled modular composition</main>") {',
修改文件
scripts/animation-map.mjs:17来自代码打开原文件
import { mkdir, writeFile } from "node:fs/promises";import { resolve, join } from "node:path";
scripts/animation-map.mjs:157来自代码打开原文件
  await writeFile(join(OUT_DIR, "animation-map.json"), JSON.stringify(report, null, 2));
scripts/animation-map.test.mjs:3来自代码打开原文件
import { spawnSync } from "node:child_process";import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";import { tmpdir } from "node:os";
读取密钥或账号配置
scripts/animation-map.test.mjs:90来自代码打开原文件
            env: {              ...process.env,              HYPERFRAMES_SKILL_NODE_MODULES: join(root, "node_modules"),
scripts/animation-map.test.mjs:105来自代码打开原文件
            env: {              ...process.env,              HYPERFRAMES_SKILL_NODE_MODULES: join(root, "node_modules"),
scripts/animation-map.test.mjs:188来自代码打开原文件
    encoding: "utf8",    env: { ...process.env, HYPERFRAMES_SKILL_NODE_MODULES: join(root, "node_modules") },  });
读取了多少行
22,325
文件校验值(用于核对版本)
356e28ecc4e6036620e63088815343d6b48f4abfc4355b05ec1be6cdfc45803a