{"id":"cmvis1rkq1jttad0705mnjef1","slug":"hyperframes","publicId":"b6683cdc-78c4-4c34-b53f-52f778abd48f","name":"hyperframes","description":"Read first to make, edit, animate or render any video with HyperFrames (HTML rendered to video), including launch films, explainers, music videos, charts, maps, vertical clips, title cards, captions and overlays. Holds the render contract, the work loop and what each kind of video needs.","version":"","author":"heygen-com","license":"Apache-2.0","compatibility":"","status":"completed","overallGrade":"F","scannerVersion":11,"fileCount":77,"hasSkillMd":true,"hasScripts":true,"hasReferences":true,"hasEvals":false,"hasAssets":true,"sourceType":"github","sourceUrl":"https://github.com/heygen-com/hyperframes/tree/main/skills/hyperframes","createdAt":"2026-10-22T00:02:45.333Z","completedAt":"2026-10-22T00:02:45.328Z","visibility":"public","publishedAt":"2026-08-05T22:05:41.633Z","category":"","frameworks":[],"badgeStatus":"flagged","downloadCount":0,"verdictRationale":{"summary":"Skill failed: 5 hard fails in security or structure checks.","verdict":"fail","scanners":[{"source":"vettd","weight":1,"verdict":"fail"},{"source":"cisco","weight":0.8,"verdict":"fail"}],"consensus":"fail","warnTriggers":[],"policyVersion":"consensus-v1","hardFailTriggers":["Shell execution without sandboxing","Shell execution without sandboxing","Shell execution without sandboxing","Shell execution without sandboxing","Shell execution without sandboxing"]},"verdictPolicyVersion":"consensus-v1","skillId":"cms4thija015mad06ekzmyo4s","findings":[{"id":"cmvis1rkq1ju0ad07hqq1mxkl","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/bake-basemap.mjs:26 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"43840df84880872b8dd8e0aecac02ead","filepath":"scripts/bake-basemap.mjs"},{"id":"cmvis1rkq1ju5ad07ccj1kxi4","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/bake-basemap.mjs:280 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"43840df84880872b8dd8e0aecac02ead","filepath":"scripts/bake-basemap.mjs"},{"id":"cmvis1rkq1ju7ad075hgffo44","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/lib/main-module.test.mjs:18 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"9d8ff8ac69e469df32111862d9d1b142","filepath":"scripts/lib/main-module.test.mjs"},{"id":"cmvis1rkq1ju6ad07ivdtk2w9","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/lib/main-module.test.mjs:4 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"9d8ff8ac69e469df32111862d9d1b142","filepath":"scripts/lib/main-module.test.mjs"},{"id":"cmvis1rkr1ju8ad07gwr0nlpg","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/locate.mjs:23 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"5821b6a2dabd557d06ccd3f97da3e2da","filepath":"scripts/locate.mjs"},{"id":"cmvis1rkr1juaad07dptl4hyh","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/plugin-cli.mjs:3 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"92521010d63e7491fad7d13f2d4f4614","filepath":"scripts/plugin-cli.mjs"},{"id":"cmvis1rkr1jubad07e5hmv5dz","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/plugin-cli.mjs:78 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"92521010d63e7491fad7d13f2d4f4614","filepath":"scripts/plugin-cli.mjs"},{"id":"cmvis1rkr1judad07hi4as43x","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/plugin-cli.test.mjs:108 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"10e8b5ffb2b434fd5f8f4c4e87cbd7b5","filepath":"scripts/plugin-cli.test.mjs"},{"id":"cmvis1rkr1jucad07hexhvhig","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/plugin-cli.test.mjs:2 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"10e8b5ffb2b434fd5f8f4c4e87cbd7b5","filepath":"scripts/plugin-cli.test.mjs"},{"id":"cmvis1rkq1jtuad07cuqkwvdn","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/bake-basemap.mjs:26 — `import { spawnSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018","owaspLlmCategory":null,"intent":"negligent","chainId":null,"fingerprint":"30fad78374b7673dbe12ed8ce3789c45","filepath":"scripts/bake-basemap.mjs"},{"id":"cmvis1rkq1jtvad07mwhz0cld","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/lib/main-module.test.mjs:4 — `import { spawnSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018","owaspLlmCategory":null,"intent":"negligent","chainId":null,"fingerprint":"7cdbfb9606a7e94b817cdf0b36429ddb","filepath":"scripts/lib/main-module.test.mjs"},{"id":"cmvis1rkq1jtwad0792xloex2","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/locate.mjs:23 — `import { execFileSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018","owaspLlmCategory":null,"intent":"negligent","chainId":null,"fingerprint":"ef2d0bef08fdb8c90c256401a9d18e6b","filepath":"scripts/locate.mjs"},{"id":"cmvis1rkq1jtxad075qk3wyzv","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/plugin-cli.mjs:3 — `import { spawnSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018","owaspLlmCategory":null,"intent":"negligent","chainId":null,"fingerprint":"899f6d23d30d21006a256f19c7ce952f","filepath":"scripts/plugin-cli.mjs"},{"id":"cmvis1rkq1jtyad07wlj9ceoa","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/plugin-cli.test.mjs:2 — `import { spawnSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018","owaspLlmCategory":null,"intent":"negligent","chainId":null,"fingerprint":"184298a414e0e1ba9c48046617f4a1ad","filepath":"scripts/plugin-cli.test.mjs"},{"id":"cmvis1rkq1ju4ad07vlpdl9bf","source":"cisco","category":"security","label":"Outbound network request primitives in JavaScript/TypeScript","detail":"scripts/bake-basemap.mjs:196 — Pattern detected: fetch(","severity":"medium","ruleId":"DATA_EXFIL_JS_NETWORK","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"9a0e979c430d87a1e6cedb8a9697146a","filepath":"scripts/bake-basemap.mjs"},{"id":"cmvis1rkr1ju9ad07848zf8ee","source":"cisco","category":"security","label":"Outbound network request primitives in JavaScript/TypeScript","detail":"scripts/locate.mjs:215 — Pattern detected: fetch(","severity":"medium","ruleId":"DATA_EXFIL_JS_NETWORK","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"0f03009ad20c0f405a7d921740171abc","filepath":"scripts/locate.mjs"},{"id":"cmvis1rkq1ju1ad077nfidkuh","source":"cisco","category":"security","label":"Script contacts a destination the documentation never mentions","detail":"scripts/bake-basemap.mjs:127 — Script contacts or configures 'server.arcgisonline.com' but the skill documentation never visibly mentions it. Undocumented network destinations can indicate behaviour the manifest and description do not disclose.","severity":"low","ruleId":"UNDECLARED_NETWORK_DESTINATION","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"dc763e942d6b4442686863286a9d3e63","filepath":"scripts/bake-basemap.mjs"},{"id":"cmvis1rkq1ju2ad073u815atr","source":"cisco","category":"security","label":"Script contacts a destination the documentation never mentions","detail":"scripts/bake-basemap.mjs:128 — Script contacts or configures 'a.basemaps.cartocdn.com' but the skill documentation never visibly mentions it. Undocumented network destinations can indicate behaviour the manifest and description do not disclose.","severity":"low","ruleId":"UNDECLARED_NETWORK_DESTINATION","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"dc763e942d6b4442686863286a9d3e63","filepath":"scripts/bake-basemap.mjs"},{"id":"cmvis1rkq1ju3ad07l1osm0rv","source":"cisco","category":"security","label":"Script contacts a destination the documentation never mentions","detail":"scripts/bake-basemap.mjs:149 — Script contacts or configures 'cdn.jsdelivr.net' but the skill documentation never visibly mentions it. Undocumented network destinations can indicate behaviour the manifest and description do not disclose.","severity":"low","ruleId":"UNDECLARED_NETWORK_DESTINATION","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"dc763e942d6b4442686863286a9d3e63","filepath":"scripts/bake-basemap.mjs"},{"id":"cmvis1rkq1jtzad07uj5f7zu7","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"592f7ac7731768f0fd0bba83f30850f9","filepath":"SKILL.md"}],"scannerRuns":[{"source":"cisco","status":"success","verdict":null,"grade":"F","findingCount":15,"criticalCount":9,"highCount":9},{"source":"vettd","status":"success","verdict":null,"grade":"F","findingCount":5,"criticalCount":5,"highCount":5}],"user":{"name":"Justin Pacella","image":"https://avatars.githubusercontent.com/u/97124458?v=4"},"repository":{"owner":"heygen-com","name":"hyperframes"},"freshness":{"status":"verified_unchanged","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-22T00:02:45.723Z","lastVerifiedAt":"2026-10-22T00:02:45.723Z","lastChangeDetectedAt":"2026-10-21T23:58:06.923Z","scannedHash":"a650bb04800097a6492bd1dce4415f89fe5cf1b6","latestUpstreamHash":"a650bb04800097a6492bd1dce4415f89fe5cf1b6","nextCheckDueAt":"2026-10-23T02:24:31.237Z"},"signalCategories":[{"category":"safety","label":"Safety","form":"graded","verdict":null,"rows":[]},{"category":"reliability","label":"Reliability & Quality","form":"graded","verdict":null,"rows":[]},{"category":"performance","label":"Performance","form":"measured","verdict":{"form":"measured","magnitudes":[{"ruleId":"performance/static-context-tokens","label":"Static context tokens","value":1687,"unit":null,"method":"tiktoken/cl100k_base/skill-md-body"}]},"rows":[{"origin":"signal","id":"cmvis1rpn1jukad07f3c0eba4","subjectType":"skill_audit","subjectId":"cmvis1rkq1jttad0705mnjef1","relatedType":"","relatedId":"","dataCategory":"performance","sourceClass":"scan","source":"vettd","ruleId":"performance/static-context-tokens","severity":null,"label":"Static context tokens","detail":null,"valueNum":1687,"valueText":null,"unit":null,"method":"tiktoken/cl100k_base/skill-md-body","derivation":null,"confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-22T00:02:40.000Z","payload":null},{"origin":"signal","id":"cmvis1rt51jvead07y5ylc0x2","subjectType":"skill_audit","subjectId":"cmvis1rkq1jttad0705mnjef1","relatedType":"","relatedId":"","dataCategory":"performance","sourceClass":"scan","source":"vettd","ruleId":"performance/progressive-disclosure","severity":null,"label":"Progressive disclosure","detail":null,"valueNum":null,"valueText":"present","unit":null,"method":null,"derivation":"read","confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-22T00:02:40.000Z","payload":null}]},{"category":"cost","label":"Cost","form":"measured","verdict":null,"rows":[]},{"category":"compatibility","label":"Compatibility","form":"unjudged","verdict":{"form":"unjudged"},"rows":[{"origin":"signal","id":"cmvis1rpv1jumad07johssmf3","subjectType":"skill_audit","subjectId":"cmvis1rkq1jttad0705mnjef1","relatedType":"","relatedId":"","dataCategory":"compatibility","sourceClass":"scan","source":"vettd","ruleId":"compatibility/declared-environment-assumptions","severity":null,"label":"Declared environment assumptions","detail":null,"valueNum":null,"valueText":"","unit":null,"method":null,"derivation":"read","confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-22T00:02:40.000Z","payload":null},{"origin":"signal","id":"cmvis1rr01juyad077joap7ar","subjectType":"skill_audit","subjectId":"cmvis1rkq1jttad0705mnjef1","relatedType":"","relatedId":"","dataCategory":"compatibility","sourceClass":"scan","source":"vettd","ruleId":"compatibility/declared-name","severity":null,"label":"Declared skill name","detail":null,"valueNum":null,"valueText":"hyperframes","unit":null,"method":null,"derivation":"read","confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-22T00:02:40.000Z","payload":null},{"origin":"signal","id":"cmvis1rte1jvgad07pk1ag01s","subjectType":"skill_audit","subjectId":"cmvis1rkq1jttad0705mnjef1","relatedType":"","relatedId":"","dataCategory":"compatibility","sourceClass":"scan","source":"vettd","ruleId":"compatibility/cli-help","severity":null,"label":"CLI help","detail":null,"valueNum":null,"valueText":"present","unit":null,"method":null,"derivation":"read","confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-22T00:02:40.000Z","payload":null},{"origin":"signal","id":"cmvis1rtm1jviad07fcv4s3qs","subjectType":"skill_audit","subjectId":"cmvis1rkq1jttad0705mnjef1","relatedType":"","relatedId":"","dataCategory":"compatibility","sourceClass":"scan","source":"vettd","ruleId":"compatibility/structured-output","severity":null,"label":"Structured output","detail":null,"valueNum":null,"valueText":"present","unit":null,"method":null,"derivation":"read","confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-22T00:02:40.000Z","payload":null}]},{"category":"sentiment","label":"Popularity","form":"unjudged","verdict":null,"rows":[]},{"category":"characteristics","label":"Characteristics","form":"unjudged","verdict":null,"rows":[]}],"signalCount":45,"publisherSupplied":["name","description","author","version","license"]}