{"id":"cmveeni280g0oad07f7ewv34v","slug":"pr-to-video","publicId":"5410f505-89fc-42bb-b77a-38d35bce7ff4","name":"pr-to-video","description":"Turn a GitHub pull request (a PR URL, owner/repo#N, or 'this PR' in a checked-out repo) into a code-change explainer video — changelog, feature reveal, fix, or refactor walkthrough built from the diff, commits, and files: the input is a code change, not a website. Not a product promo (/product-launch-video) or a no-PR topic explainer (/faceless-explainer). Unclear → /hyperframes.","version":"","author":"heygen-com","license":"Apache-2.0","compatibility":"","status":"completed","overallGrade":"F","scannerVersion":11,"fileCount":35,"hasSkillMd":true,"hasScripts":true,"hasReferences":true,"hasEvals":false,"hasAssets":false,"sourceType":"github","sourceUrl":"https://github.com/heygen-com/hyperframes/tree/main/skills/pr-to-video","createdAt":"2026-10-18T22:36:40.111Z","completedAt":"2026-10-18T22:36:40.107Z","visibility":"public","publishedAt":"2026-08-05T22:05:18.044Z","category":"","frameworks":[],"badgeStatus":"flagged","downloadCount":0,"verdictRationale":{"summary":"Skill failed: 7 hard fails in security or structure checks.","verdict":"fail","scanners":[{"source":"vettd","weight":1,"verdict":"fail"},{"source":"cisco","weight":0.8,"verdict":"fail"}],"consensus":"fail","warnTriggers":[],"policyVersion":"consensus-v1","hardFailTriggers":["Shell execution without sandboxing","Shell execution without sandboxing","Shell execution without sandboxing","Shell execution without sandboxing","Shell execution without sandboxing","Shell execution without sandboxing","Shell execution without sandboxing"]},"verdictPolicyVersion":"consensus-v1","skillId":"cmsgmy4gb01pdad07eduonn0x","findings":[{"id":"cmveeni290g1aad07exhleue8","source":"cisco","category":"security","label":"INJECTION ATTACK detected by YARA","detail":"scripts/captions.test.mjs:226 — Script injection patterns: onerror=\"alert(","severity":"critical","ruleId":"YARA_script_injection_generic","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"c46fa569ff056bd2a5d83a7a0fce45fb","filepath":"scripts/captions.test.mjs"},{"id":"cmveeni280g0zad07503ccv2g","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.mjs:101 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"4404432f21145f0218b46fe9c1769ffa","filepath":"scripts/assemble-index.mjs"},{"id":"cmveeni280g0xad074elakltr","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.mjs:54 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"4404432f21145f0218b46fe9c1769ffa","filepath":"scripts/assemble-index.mjs"},{"id":"cmveeni280g0yad07c5n0okwm","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.mjs:85 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"4404432f21145f0218b46fe9c1769ffa","filepath":"scripts/assemble-index.mjs"},{"id":"cmveeni280g12ad07r08tj8ib","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.test.mjs:10 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"2183ee90adf78626013a9b2a8b559515","filepath":"scripts/assemble-index.test.mjs"},{"id":"cmveeni290g13ad07vlo5uu6k","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.test.mjs:11 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"2183ee90adf78626013a9b2a8b559515","filepath":"scripts/assemble-index.test.mjs"},{"id":"cmveeni290g16ad07ovhrjq3c","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.test.mjs:123 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"2183ee90adf78626013a9b2a8b559515","filepath":"scripts/assemble-index.test.mjs"},{"id":"cmveeni290g14ad07g4rjxod8","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.test.mjs:35 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"2183ee90adf78626013a9b2a8b559515","filepath":"scripts/assemble-index.test.mjs"},{"id":"cmveeni280g11ad07p9zarmnb","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.test.mjs:5 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"2183ee90adf78626013a9b2a8b559515","filepath":"scripts/assemble-index.test.mjs"},{"id":"cmveeni290g15ad07dqtp2nql","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.test.mjs:97 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"2183ee90adf78626013a9b2a8b559515","filepath":"scripts/assemble-index.test.mjs"},{"id":"cmveeni290g17ad07q78gmuun","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/audio.mjs:25 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"05841aed0ee153160297839b837a6fac","filepath":"scripts/audio.mjs"},{"id":"cmveeni290g18ad07jovtejha","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/audio.mjs:88 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"05841aed0ee153160297839b837a6fac","filepath":"scripts/audio.mjs"},{"id":"cmveeni290g19ad07ysofkrz7","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/captions.test.mjs:2 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"46e24566920b891bd1187ba60208121b","filepath":"scripts/captions.test.mjs"},{"id":"cmveeni290g1cad07jrkvhjgl","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/fetch-pr.mjs:28 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"058b8ee92f0cfaed5ec3416f2ab1cf79","filepath":"scripts/fetch-pr.mjs"},{"id":"cmveeni290g1dad07i459fd7b","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/frame-contract.test.mjs:2 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"576691d8059003750cca3e8071613097","filepath":"scripts/frame-contract.test.mjs"},{"id":"cmveeni290g1ead07gty45muf","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/preflight.mjs:3 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"98f1da28b08605bc7a3d26e57c62fd75","filepath":"scripts/preflight.mjs"},{"id":"cmveeni280g0pad07o0pcd1sf","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/assemble-index.mjs:54 — `import { spawnSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018","owaspLlmCategory":null,"intent":"negligent","chainId":null,"fingerprint":"9584474f4877cf450071e272e4017d48","filepath":"scripts/assemble-index.mjs"},{"id":"cmveeni280g0qad07nb44j9uq","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/assemble-index.test.mjs:5 — `import { spawnSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018","owaspLlmCategory":null,"intent":"negligent","chainId":null,"fingerprint":"3490d53c23cb1279cd2355ff8c625dc8","filepath":"scripts/assemble-index.test.mjs"},{"id":"cmveeni280g0rad07r8b7eymp","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/audio.mjs:25 — `import { spawnSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018","owaspLlmCategory":null,"intent":"negligent","chainId":null,"fingerprint":"e251b9d4fd26fbcd471e2c702ef01a20","filepath":"scripts/audio.mjs"},{"id":"cmveeni280g0sad070ktmaqvo","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/captions.test.mjs:2 — `import { execFileSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018","owaspLlmCategory":null,"intent":"negligent","chainId":null,"fingerprint":"73ee4f335a18f9437d12f3fb297a60cb","filepath":"scripts/captions.test.mjs"},{"id":"cmveeni280g0tad0787k3002h","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/fetch-pr.mjs:28 — `import { execFileSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018","owaspLlmCategory":null,"intent":"negligent","chainId":null,"fingerprint":"16ff914f4f890afcb386a1e928aa0f55","filepath":"scripts/fetch-pr.mjs"},{"id":"cmveeni280g0uad071h251ndm","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/frame-contract.test.mjs:2 — `import { execFileSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018","owaspLlmCategory":null,"intent":"negligent","chainId":null,"fingerprint":"4676010f219de36833310434e3eaa779","filepath":"scripts/frame-contract.test.mjs"},{"id":"cmveeni280g0vad0733pfnevi","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/preflight.mjs:3 — `import { spawnSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018","owaspLlmCategory":null,"intent":"negligent","chainId":null,"fingerprint":"bca280c2eecfb17d6134cca1035ca68f","filepath":"scripts/preflight.mjs"},{"id":"cmveeni290g1bad07ptvryl2a","source":"cisco","category":"security","label":"Outbound network request primitives in JavaScript/TypeScript","detail":"scripts/fetch-people-avatars.mjs:114 — Pattern detected: fetch(","severity":"medium","ruleId":"DATA_EXFIL_JS_NETWORK","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"e591b0c3b274df7dc9ab507d128bbc2c","filepath":"scripts/fetch-people-avatars.mjs"},{"id":"cmveeni280g10ad07eqz00nwr","source":"cisco","category":"security","label":"Script contacts a destination the documentation never mentions","detail":"scripts/assemble-index.mjs:587 — Script contacts or configures 'cdn.jsdelivr.net' but the skill documentation never visibly mentions it. Undocumented network destinations can indicate behaviour the manifest and description do not disclose.","severity":"low","ruleId":"UNDECLARED_NETWORK_DESTINATION","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"adc20c36aa3812e1cbd322d36c096d53","filepath":"scripts/assemble-index.mjs"},{"id":"cmveeni280g0wad070opdtqbi","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"592f7ac7731768f0fd0bba83f30850f9","filepath":"SKILL.md"}],"scannerRuns":[{"source":"cisco","status":"success","verdict":null,"grade":"F","findingCount":19,"criticalCount":16,"highCount":16},{"source":"vettd","status":"success","verdict":null,"grade":"F","findingCount":7,"criticalCount":7,"highCount":7}],"user":{"name":"Justin Pacella","image":"https://avatars.githubusercontent.com/u/97124458?v=4"},"repository":{"owner":"heygen-com","name":"hyperframes"},"freshness":{"status":"unreachable","reason":"ref_not_found","retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-21T21:38:22.016Z","lastVerifiedAt":"2026-10-20T22:08:48.097Z","lastChangeDetectedAt":"2026-10-18T22:35:03.556Z","scannedHash":"01e34d507b8c0502dcdc81d7a3b1ba6ef34cad84","latestUpstreamHash":"01e34d507b8c0502dcdc81d7a3b1ba6ef34cad84","nextCheckDueAt":"2026-10-28T21:38:22.016Z"},"signalCategories":[{"category":"safety","label":"Safety","form":"graded","verdict":null,"rows":[]},{"category":"reliability","label":"Reliability & Quality","form":"graded","verdict":null,"rows":[]},{"category":"performance","label":"Performance","form":"measured","verdict":{"form":"measured","magnitudes":[{"ruleId":"performance/static-context-tokens","label":"Static context tokens","value":7576,"unit":null,"method":"tiktoken/cl100k_base/skill-md-body"}]},"rows":[{"origin":"signal","id":"cmveeni6i0g1lad072d2jum5p","subjectType":"skill_audit","subjectId":"cmveeni280g0oad07f7ewv34v","relatedType":"","relatedId":"","dataCategory":"performance","sourceClass":"scan","source":"vettd","ruleId":"performance/static-context-tokens","severity":null,"label":"Static context tokens","detail":null,"valueNum":7576,"valueText":null,"unit":null,"method":"tiktoken/cl100k_base/skill-md-body","derivation":null,"confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-18T22:36:37.000Z","payload":null},{"origin":"signal","id":"cmveenimr0g2fad07emcyxs2a","subjectType":"skill_audit","subjectId":"cmveeni280g0oad07f7ewv34v","relatedType":"","relatedId":"","dataCategory":"performance","sourceClass":"scan","source":"vettd","ruleId":"performance/progressive-disclosure","severity":null,"label":"Progressive disclosure","detail":null,"valueNum":null,"valueText":"present","unit":null,"method":null,"derivation":"read","confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-18T22:36:37.000Z","payload":null}]},{"category":"cost","label":"Cost","form":"measured","verdict":null,"rows":[]},{"category":"compatibility","label":"Compatibility","form":"unjudged","verdict":{"form":"unjudged"},"rows":[{"origin":"signal","id":"cmveeni6p0g1nad0777v6qaiz","subjectType":"skill_audit","subjectId":"cmveeni280g0oad07f7ewv34v","relatedType":"","relatedId":"","dataCategory":"compatibility","sourceClass":"scan","source":"vettd","ruleId":"compatibility/declared-environment-assumptions","severity":null,"label":"Declared environment assumptions","detail":null,"valueNum":null,"valueText":"","unit":null,"method":null,"derivation":"read","confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-18T22:36:37.000Z","payload":null},{"origin":"signal","id":"cmveenibr0g1zad07qqevsllj","subjectType":"skill_audit","subjectId":"cmveeni280g0oad07f7ewv34v","relatedType":"","relatedId":"","dataCategory":"compatibility","sourceClass":"scan","source":"vettd","ruleId":"compatibility/declared-name","severity":null,"label":"Declared skill name","detail":null,"valueNum":null,"valueText":"pr-to-video","unit":null,"method":null,"derivation":"read","confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-18T22:36:37.000Z","payload":null},{"origin":"signal","id":"cmveenimy0g2had0791nt8c2a","subjectType":"skill_audit","subjectId":"cmveeni280g0oad07f7ewv34v","relatedType":"","relatedId":"","dataCategory":"compatibility","sourceClass":"scan","source":"vettd","ruleId":"compatibility/cli-help","severity":null,"label":"CLI help","detail":null,"valueNum":null,"valueText":"present","unit":null,"method":null,"derivation":"read","confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-18T22:36:37.000Z","payload":null},{"origin":"signal","id":"cmveenin40g2jad07rimg49ij","subjectType":"skill_audit","subjectId":"cmveeni280g0oad07f7ewv34v","relatedType":"","relatedId":"","dataCategory":"compatibility","sourceClass":"scan","source":"vettd","ruleId":"compatibility/structured-output","severity":null,"label":"Structured output","detail":null,"valueNum":null,"valueText":"present","unit":null,"method":null,"derivation":"read","confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-18T22:36:37.000Z","payload":null}]},{"category":"sentiment","label":"Popularity","form":"unjudged","verdict":null,"rows":[]},{"category":"characteristics","label":"Characteristics","form":"unjudged","verdict":null,"rows":[]}],"signalCount":51,"publisherSupplied":["name","description","author","version","license"]}