{"id":"cmsf3lnf400h6ad07tv1wxvy4","owner":"heygen-com","name":"hyperframes","url":"https://github.com/heygen-com/hyperframes","lastScannedAt":"2026-10-22T04:48:38.305Z","freshness":{"status":"changed","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-21T09:36:39.033Z","lastVerifiedAt":null,"lastChangeDetectedAt":"2026-10-21T09:36:39.033Z","scannedHash":null,"latestUpstreamHash":"1d422a2fa5b4c00be837379ba60d1a76f1c7ded9","nextCheckDueAt":"2026-10-22T08:56:45.715Z"},"skills":[{"id":"cmvhffgpc15z5ad07wiqqqa3q","slug":"hyperframes-creative","publicId":"aba525f2-5ce2-47f2-b6e0-cda3a706a145","name":"hyperframes-creative","description":"Non-animation creative direction for HyperFrames videos. Use for design spec (frame.md / design.md) handling, palettes, typography, narration, beat planning, audio-reactive visuals, composition patterns, and brand / style decisions. For atomic motion patterns and scene blueprints, use `hyperframes-animation`.","author":"","version":"","license":"Apache-2.0","overallGrade":"F","badgeStatus":"flagged","publishedAt":"2026-08-06T00:11:37.146Z","sourceUrl":"https://github.com/heygen-com/hyperframes/tree/main/skills/hyperframes-creative","findings":[{"id":"cmvhffgpd15z6ad07xc6vqenr","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/package-loader.mjs:11 — `import { spawnSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmvhffgpd15z7ad07kkr8vdbl","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/package-loader.test.mjs:3 — `import { spawnSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmvhffgpd15z8ad077hqgk3oi","source":"vettd","category":"security","label":"References external URL — review for indirect prompt injection risk","detail":"External URL(s) detected in references/design-picker.md — referenced content can change after audit","severity":"medium","ruleId":"VTD-0088"},{"id":"cmvhffgpd15z9ad07hxihe8la","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE"},{"id":"cmvhffgpd15zaad079lk85ze1","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/package-loader.mjs:11 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvhffgpd15zbad075g2tsju6","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/package-loader.mjs:389 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvhffgpd15zcad07u457n87o","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/package-loader.mjs:398 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvhffgpd15zdad072zxarkqn","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/package-loader.test.mjs:3 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvhffgpd15zead07yjm6g8rj","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/package-loader.test.mjs:54 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvhffgpd15zfad075ov2vy6a","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/package-loader.test.mjs:106 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"}],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":"F","criticalCount":2,"highCount":2},{"source":"cisco","status":"success","verdict":null,"grade":"F","criticalCount":6,"highCount":6}],"freshness":{"status":"unreachable","reason":"ref_not_found","retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-22T03:05:39.538Z","lastVerifiedAt":"2026-10-21T01:21:43.648Z","lastChangeDetectedAt":"2026-10-21T01:21:07.947Z","scannedHash":"9f6199a8f8cceeb215e1d97129079c80383be4eb","latestUpstreamHash":"9f6199a8f8cceeb215e1d97129079c80383be4eb","nextCheckDueAt":"2026-10-29T03:05:39.538Z"}},{"id":"cmvfft3100lfkad073j2p8pfq","slug":"hyperframes-animation","publicId":"d8550fe6-16e2-4e49-bd7e-c38c10152481","name":"hyperframes-animation","description":"All animation knowledge for HyperFrames — atomic motion rules, multi-phase scene blueprints, scene transitions, broader motion-design techniques, AND the seven runtime adapters (GSAP default, plus Lottie, Three.js, Anime.js, CSS keyframes, Web Animations API, TypeGPU). Use for any motion or animation task: pick 2-4 rules and compose, or load a blueprint, or look up runtime-specific API (e.g. GSAP eases / Lottie player / Three.js mixer). Also covers auditing an existing composition's choreography (animation map) and 24 named text-animation effects. HyperFrames-native: single paused timeline, seek-safe, deterministic.","author":"","version":"","license":"Apache-2.0","overallGrade":"F","badgeStatus":"flagged","publishedAt":"2026-08-06T00:11:37.145Z","sourceUrl":"https://github.com/heygen-com/hyperframes/tree/main/skills/hyperframes-animation","findings":[{"id":"cmvfft3100lflad07rze2pmbi","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/animation-map.test.mjs:2 — `import { spawnSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmvfft3100lfmad07fu9yy1fx","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/package-loader.mjs:11 — `import { spawnSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmvfft3100lfnad072ouobzc5","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/package-loader.test.mjs:3 — `import { spawnSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmvfft3100lfoad07owu3wjqp","source":"vettd","category":"security","label":"Unrestricted operation framing","detail":"Detected in transitions/overview.md:149 — `these rules only apply to shader transition compositions. css-only compositions have no restrictions.`","severity":"medium","ruleId":"VTD-0070"},{"id":"cmvfft3110lfpad07bcvcfjst","source":"cisco","category":"security","label":"Skill package contains many files","detail":". — Skill package contains 122 files. Large file counts increase attack surface and may indicate bundled dependencies or unnecessary content.","severity":"low","ruleId":"EXCESSIVE_FILE_COUNT"},{"id":"cmvfft3110lfqad0753iw1do1","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE"},{"id":"cmvfft3110lfrad079042e62i","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/animation-map.test.mjs:2 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvfft3110lfsad073enlvb1d","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/animation-map.test.mjs:84 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvfft3110lftad07i6x3yu5w","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/animation-map.test.mjs:99 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvfft3110lfuad07kj18jptt","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/animation-map.test.mjs:186 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvfft3110lfvad07yz7wxtjo","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/package-loader.mjs:11 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvfft3110lfwad07qqx7z9zu","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/package-loader.mjs:389 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvfft3110lfxad07nd50h6gv","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/package-loader.mjs:398 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvfft3110lfyad0722ryjxh4","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/package-loader.test.mjs:3 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvfft3110lfzad07pa5ffu6d","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/package-loader.test.mjs:54 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvfft3110lg0ad07e61uc5ut","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/package-loader.test.mjs:106 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"}],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":"F","criticalCount":3,"highCount":3},{"source":"cisco","status":"success","verdict":null,"grade":"F","criticalCount":10,"highCount":10}],"freshness":{"status":"verified_unchanged","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-21T18:26:41.286Z","lastVerifiedAt":"2026-10-21T18:26:41.286Z","lastChangeDetectedAt":"2026-10-19T15:53:51.541Z","scannedHash":"284a8f10bb196a6087d52ff6e0e13827602d10ed","latestUpstreamHash":"284a8f10bb196a6087d52ff6e0e13827602d10ed","nextCheckDueAt":"2026-10-22T17:52:54.534Z"}},{"id":"cmv8lagi6ecxuad0654kdkz1p","slug":"music-to-video","publicId":"f0ffb981-b55b-4637-878a-18e32692a67d","name":"music-to-video","description":"Turn a music track (an audio file, a video to pull audio from, or a track generated from a mood brief) into a beat-synced video — lyric video, slideshow, or kinetic promo. The music drives all pacing; any user-supplied images/videos are cut onto the same beat grid, and a complete video needs zero assets. Narrated pieces → the input-matched workflow (see /hyperframes). Unclear → /hyperframes.","author":"","version":"","license":"Apache-2.0","overallGrade":"B","badgeStatus":"conditional","publishedAt":"2026-08-06T00:11:34.521Z","sourceUrl":"https://github.com/heygen-com/hyperframes/tree/main/skills/music-to-video","findings":[{"id":"cmv8lagi6ecxvad06wnah7p7e","source":"vettd","category":"security","label":"References external URL — review for indirect prompt injection risk","detail":"External URL(s) detected in references/motion-primitives/assets/gsap.min.js — referenced content can change after audit","severity":"medium","ruleId":"VTD-0088"},{"id":"cmv8lagi6ecxwad06gzpl7csu","source":"cisco","category":"security","label":"Skill package contains many files","detail":". — Skill package contains 102 files. Large file counts increase attack surface and may indicate bundled dependencies or unnecessary content.","severity":"low","ruleId":"EXCESSIVE_FILE_COUNT"},{"id":"cmv8lagi6ecxxad06x6kkziaz","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE"},{"id":"cmv8lagi6ecxyad06givfgdaj","source":"cisco","category":"security","label":"Script contacts a destination the documentation never mentions","detail":"references/motion-primitives/assets/gsap.min.js:10 — Script contacts or configures 'gsap.com' but the skill documentation never visibly mentions it. Undocumented network destinations can indicate behaviour the manifest and description do not disclose.","severity":"low","ruleId":"UNDECLARED_NETWORK_DESTINATION"},{"id":"cmv8lagi6ecxzad06impavd96","source":"cisco","category":"security","label":"Script contacts a destination the documentation never mentions","detail":"scripts/assemble-index.mjs:185 — Script contacts or configures 'cdn.jsdelivr.net' but the skill documentation never visibly mentions it. Undocumented network destinations can indicate behaviour the manifest and description do not disclose.","severity":"low","ruleId":"UNDECLARED_NETWORK_DESTINATION"}],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":"B","criticalCount":0,"highCount":0},{"source":"cisco","status":"success","verdict":null,"grade":"A","criticalCount":0,"highCount":0}],"freshness":{"status":"verified_unchanged","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-21T17:59:41.235Z","lastVerifiedAt":"2026-10-21T17:59:41.235Z","lastChangeDetectedAt":"2026-10-14T20:50:56.725Z","scannedHash":"cd5cb49b2ccc621f3dc5a7f21b7d88d4d1880a27","latestUpstreamHash":"cd5cb49b2ccc621f3dc5a7f21b7d88d4d1880a27","nextCheckDueAt":"2026-10-22T17:53:17.908Z"}},{"id":"cmuxiqlp50x6pad07ey6f5lzl","slug":"remotion-to-hyperframes","publicId":"a1fadba0-1d34-4ec8-b1b6-629ac179656d","name":"remotion-to-hyperframes","description":"Port an existing Remotion (React) composition''s source to HyperFrames HTML. Use ONLY on an explicit ask to port/convert/migrate/translate a Remotion source — one-way, Remotion-only. A passing Remotion mention, reference-only code, or \"make something like my Remotion video\" is a fresh build (/general-video). Unclear → /hyperframes.","author":"","version":"","license":"Apache-2.0","overallGrade":"C","badgeStatus":"conditional","publishedAt":"2026-08-06T00:11:33.767Z","sourceUrl":"https://github.com/heygen-com/hyperframes/tree/main/skills/remotion-to-hyperframes","findings":[{"id":"cmuxiqlp60x6qad07il7989iu","source":"vettd","category":"security","label":"References external URL — review for indirect prompt injection risk","detail":"External URL(s) detected in SKILL.md — referenced content can change after audit","severity":"medium","ruleId":"VTD-0088"},{"id":"cmuxiqlp60x6rad0742k4ffeg","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE"},{"id":"cmuxiqlp60x6sad07wc6gbbxq","source":"cisco","category":"security","label":"Unpinned dependency","detail":"assets/test-corpus/tier-1-title-card/remotion-src/package.json:9 — Dependency '@remotion/cli' has no exact version. Unpinned dependencies in a skill package allow a later, potentially malicious release to be installed automatically (supply-chain risk).","severity":"low","ruleId":"SUPPLY_CHAIN_UNPINNED_DEPENDENCY"},{"id":"cmuxiqlp60x6tad07jlphpqnt","source":"cisco","category":"security","label":"Unpinned dependency","detail":"assets/test-corpus/tier-1-title-card/remotion-src/package.json:10 — Dependency 'react' has no exact version. Unpinned dependencies in a skill package allow a later, potentially malicious release to be installed automatically (supply-chain risk).","severity":"low","ruleId":"SUPPLY_CHAIN_UNPINNED_DEPENDENCY"},{"id":"cmuxiqlp60x6uad07ro35tt2h","source":"cisco","category":"security","label":"Unpinned dependency","detail":"assets/test-corpus/tier-1-title-card/remotion-src/package.json:11 — Dependency 'react-dom' has no exact version. Unpinned dependencies in a skill package allow a later, potentially malicious release to be installed automatically (supply-chain risk).","severity":"low","ruleId":"SUPPLY_CHAIN_UNPINNED_DEPENDENCY"},{"id":"cmuxiqlp60x6vad07lvupcwnj","source":"cisco","category":"security","label":"Unpinned dependency","detail":"assets/test-corpus/tier-1-title-card/remotion-src/package.json:12 — Dependency 'remotion' has no exact version. Unpinned dependencies in a skill package allow a later, potentially malicious release to be installed automatically (supply-chain risk).","severity":"low","ruleId":"SUPPLY_CHAIN_UNPINNED_DEPENDENCY"},{"id":"cmuxiqlp60x6wad075dkumtul","source":"cisco","category":"security","label":"Unpinned dependency","detail":"assets/test-corpus/tier-2-multi-scene/remotion-src/package.json:9 — Dependency '@remotion/cli' has no exact version. Unpinned dependencies in a skill package allow a later, potentially malicious release to be installed automatically (supply-chain risk).","severity":"low","ruleId":"SUPPLY_CHAIN_UNPINNED_DEPENDENCY"},{"id":"cmuxiqlp60x6xad07mc2l9khi","source":"cisco","category":"security","label":"Unpinned dependency","detail":"assets/test-corpus/tier-2-multi-scene/remotion-src/package.json:10 — Dependency 'react' has no exact version. Unpinned dependencies in a skill package allow a later, potentially malicious release to be installed automatically (supply-chain risk).","severity":"low","ruleId":"SUPPLY_CHAIN_UNPINNED_DEPENDENCY"},{"id":"cmuxiqlp60x6yad07yb3wp9g0","source":"cisco","category":"security","label":"Unpinned dependency","detail":"assets/test-corpus/tier-2-multi-scene/remotion-src/package.json:11 — Dependency 'react-dom' has no exact version. Unpinned dependencies in a skill package allow a later, potentially malicious release to be installed automatically (supply-chain risk).","severity":"low","ruleId":"SUPPLY_CHAIN_UNPINNED_DEPENDENCY"},{"id":"cmuxiqlp60x6zad07z3prz8bd","source":"cisco","category":"security","label":"Unpinned dependency","detail":"assets/test-corpus/tier-2-multi-scene/remotion-src/package.json:12 — Dependency 'remotion' has no exact version. Unpinned dependencies in a skill package allow a later, potentially malicious release to be installed automatically (supply-chain risk).","severity":"low","ruleId":"SUPPLY_CHAIN_UNPINNED_DEPENDENCY"},{"id":"cmuxiqlp60x70ad070juro8v2","source":"cisco","category":"security","label":"Unpinned dependency","detail":"assets/test-corpus/tier-3-data-driven/remotion-src/package.json:9 — Dependency '@remotion/cli' has no exact version. Unpinned dependencies in a skill package allow a later, potentially malicious release to be installed automatically (supply-chain risk).","severity":"low","ruleId":"SUPPLY_CHAIN_UNPINNED_DEPENDENCY"},{"id":"cmuxiqlp60x71ad07qnhqbn51","source":"cisco","category":"security","label":"Unpinned dependency","detail":"assets/test-corpus/tier-3-data-driven/remotion-src/package.json:10 — Dependency 'react' has no exact version. Unpinned dependencies in a skill package allow a later, potentially malicious release to be installed automatically (supply-chain risk).","severity":"low","ruleId":"SUPPLY_CHAIN_UNPINNED_DEPENDENCY"},{"id":"cmuxiqlp60x72ad07wxxsr7k4","source":"cisco","category":"security","label":"Unpinned dependency","detail":"assets/test-corpus/tier-3-data-driven/remotion-src/package.json:11 — Dependency 'react-dom' has no exact version. Unpinned dependencies in a skill package allow a later, potentially malicious release to be installed automatically (supply-chain risk).","severity":"low","ruleId":"SUPPLY_CHAIN_UNPINNED_DEPENDENCY"},{"id":"cmuxiqlp60x73ad07hdn6enio","source":"cisco","category":"security","label":"Unpinned dependency","detail":"assets/test-corpus/tier-3-data-driven/remotion-src/package.json:12 — Dependency 'remotion' has no exact version. Unpinned dependencies in a skill package allow a later, potentially malicious release to be installed automatically (supply-chain risk).","severity":"low","ruleId":"SUPPLY_CHAIN_UNPINNED_DEPENDENCY"},{"id":"cmuxiqlp60x74ad07p2efwxuu","source":"cisco","category":"security","label":"Unpinned dependency","detail":"assets/test-corpus/tier-3-data-driven/remotion-src/package.json:13 — Dependency 'zod' has no exact version. Unpinned dependencies in a skill package allow a later, potentially malicious release to be installed automatically (supply-chain risk).","severity":"low","ruleId":"SUPPLY_CHAIN_UNPINNED_DEPENDENCY"},{"id":"cmuxiqlp60x75ad075ffzkxrl","source":"cisco","category":"security","label":"Outbound network request primitives in JavaScript/TypeScript","detail":"assets/test-corpus/tier-4-escape-hatch/cases/03-async-metadata.tsx:31 — Pattern detected: fetch(","severity":"medium","ruleId":"DATA_EXFIL_JS_NETWORK"},{"id":"cmuxiqlp60x76ad073i1kuabw","source":"cisco","category":"security","label":"Outbound network request primitives in JavaScript/TypeScript","detail":"assets/test-corpus/tier-4-escape-hatch/cases/08-mixed.tsx:25 — Pattern detected: fetch(","severity":"medium","ruleId":"DATA_EXFIL_JS_NETWORK"},{"id":"cmuxiqlp60x77ad07j5lgacel","source":"cisco","category":"security","label":"File extension does not match actual content type","detail":"scripts/render_diff.sh — File 'render_diff.sh' extension (.sh) suggests one format but Magika detected a different text format: Python source (python). This may indicate content obfuscation or a misnamed file.","severity":"medium","ruleId":"FILE_MAGIC_MISMATCH"}],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":"B","criticalCount":0,"highCount":0},{"source":"cisco","status":"success","verdict":null,"grade":"C","criticalCount":0,"highCount":0}],"freshness":{"status":"verified_unchanged","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-21T12:58:58.257Z","lastVerifiedAt":"2026-10-21T12:58:58.257Z","lastChangeDetectedAt":"2026-10-09T11:09:29.490Z","scannedHash":"5053f1396fbb4e34c5c768e1ff66d99b179231d9","latestUpstreamHash":"5053f1396fbb4e34c5c768e1ff66d99b179231d9","nextCheckDueAt":"2026-10-22T12:30:02.608Z"}},{"id":"cmuxm1w5322gmad070wp7rwg2","slug":"seam-craft","publicId":"03c9d085-9a84-4729-8296-fb869b921946","name":"seam-craft","description":"Render-correctness doctrine for scene-to-scene seams in HyperFrames launch videos — the prerequisites that make transitions composite correctly on the master timeline. Load when assembling the master timeline / index.html, when a white flash appears at a cut or crossfade seam (especially on dark films), when reasoning about why a transition opacity dip shows through, or when verifying the render-side mechanics of how overlapping scene wrappers blend. Covers the opaque stage-ground (#root background) white-flash guard and how the injector overlaps wrappers, holds final frames, ping-pongs tracks, and stamps lint-clean template code onto the master timeline. Does NOT contain the per-transition catalog — see the transition registry for individual transition entries.","author":"","version":"","license":"Apache-2.0","overallGrade":"A","badgeStatus":"vettd","publishedAt":"2026-08-06T00:11:32.810Z","sourceUrl":"https://github.com/heygen-com/hyperframes/tree/main/.agents/skills/seam-craft","findings":[{"id":"cmuxm1w5322gnad07jwz7lnk4","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE"}],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":"A","criticalCount":0,"highCount":0},{"source":"cisco","status":"success","verdict":null,"grade":"A","criticalCount":0,"highCount":0}],"freshness":{"status":"verified_unchanged","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-22T01:51:39.465Z","lastVerifiedAt":"2026-10-22T01:51:39.465Z","lastChangeDetectedAt":"2026-10-09T10:06:29.368Z","scannedHash":"c7d92e248a42c60118f91c02a56c3695c4a0c998","latestUpstreamHash":"c7d92e248a42c60118f91c02a56c3695c4a0c998","nextCheckDueAt":"2026-10-23T00:24:26.080Z"}},{"id":"cmvfpwve30vmnad073j0hwfq1","slug":"motion-graphics","publicId":"c385b5fe-1f53-4052-bcce-ae053e2ccd54","name":"motion-graphics","description":">","author":"","version":"","license":"Apache-2.0","overallGrade":"F","badgeStatus":"flagged","publishedAt":"2026-08-06T00:11:32.715Z","sourceUrl":"https://github.com/heygen-com/hyperframes/tree/main/skills/motion-graphics","findings":[{"id":"cmvfpwve30vmoad07t00ek2pj","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in categories/maps/bake-basemap.mjs:25 — `import { spawnSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmvfpwve30vmpad07izp56guj","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in grounding/locate.mjs:23 — `import { execFileSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmvfpwve30vmqad07xkvzgbyn","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE"},{"id":"cmvfpwve30vmrad079autulfc","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"categories/maps/bake-basemap.mjs:25 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvfpwve30vmsad077bjdjlo8","source":"cisco","category":"security","label":"Script contacts a destination the documentation never mentions","detail":"categories/maps/bake-basemap.mjs:106 — Script contacts or configures 'server.arcgisonline.com' but the skill documentation never visibly mentions it. Undocumented network destinations can indicate behaviour the manifest and description do not disclose.","severity":"low","ruleId":"UNDECLARED_NETWORK_DESTINATION"},{"id":"cmvfpwve30vmtad079ijwl421","source":"cisco","category":"security","label":"Script contacts a destination the documentation never mentions","detail":"categories/maps/bake-basemap.mjs:107 — Script contacts or configures 'a.basemaps.cartocdn.com' but the skill documentation never visibly mentions it. Undocumented network destinations can indicate behaviour the manifest and description do not disclose.","severity":"low","ruleId":"UNDECLARED_NETWORK_DESTINATION"},{"id":"cmvfpwve30vmuad072wpdxrkc","source":"cisco","category":"security","label":"Script contacts a destination the documentation never mentions","detail":"categories/maps/bake-basemap.mjs:117 — Script contacts or configures 'cdn.jsdelivr.net' but the skill documentation never visibly mentions it. Undocumented network destinations can indicate behaviour the manifest and description do not disclose.","severity":"low","ruleId":"UNDECLARED_NETWORK_DESTINATION"},{"id":"cmvfpwve30vmvad07td2znvig","source":"cisco","category":"security","label":"Outbound network request primitives in JavaScript/TypeScript","detail":"categories/maps/bake-basemap.mjs:153 — Pattern detected: fetch(","severity":"medium","ruleId":"DATA_EXFIL_JS_NETWORK"},{"id":"cmvfpwve30vmwad07qvd2oiws","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"categories/maps/bake-basemap.mjs:229 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvfpwve30vmxad07agp1axqd","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"grounding/locate.mjs:23 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvfpwve30vmyad07u2c6mt6m","source":"cisco","category":"security","label":"Outbound network request primitives in JavaScript/TypeScript","detail":"grounding/locate.mjs:215 — Pattern detected: fetch(","severity":"medium","ruleId":"DATA_EXFIL_JS_NETWORK"}],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":"F","criticalCount":2,"highCount":2},{"source":"cisco","status":"success","verdict":null,"grade":"F","criticalCount":3,"highCount":3}],"freshness":{"status":"unreachable","reason":"ref_not_found","retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-21T20:11:41.539Z","lastVerifiedAt":"2026-10-20T19:44:28.158Z","lastChangeDetectedAt":"2026-10-19T20:35:42.821Z","scannedHash":"b91d621a3b589e2046266979c9135599b16b99ab","latestUpstreamHash":"b91d621a3b589e2046266979c9135599b16b99ab","nextCheckDueAt":"2026-10-28T20:11:41.539Z"}},{"id":"cmve8d4rx0f6tad07f0lmnwep","slug":"product-launch-video","publicId":"927aca14-21af-49ca-add3-9eba313a611c","name":"product-launch-video","description":"Turn a product or marketing URL, pasted script, or brief into a product launch / promo video — SaaS promos, feature reveals, product demos, app and company launches. Use when the user wants to market, launch, promote, or reveal a product; the default for any commercial URL. Site tours / showcases of a website route here too — the brief carries the show-it-as-is intent. Unclear → /hyperframes.","author":"","version":"","license":"Apache-2.0","overallGrade":"F","badgeStatus":"flagged","publishedAt":"2026-08-06T00:11:31.700Z","sourceUrl":"https://github.com/heygen-com/hyperframes/tree/main/skills/product-launch-video","findings":[{"id":"cmve8d4rx0f6uad074sklc46r","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/assemble-index.mjs:54 — `import { spawnSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmve8d4rx0f6vad07otxfndad","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/assemble-index.test.mjs:5 — `import { spawnSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmve8d4rx0f6wad079yaxh3mu","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/audio.mjs:23 — `import { spawnSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmve8d4rx0f6xad07we2ahcqg","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/audio.test.mjs:5 — `import { spawnSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmve8d4rx0f6yad07sfierk4r","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/build-frame-colors.test.mjs:2 — `import { spawnSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmve8d4rx0f6zad07ujpo7qz2","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/build-frame-subsets.test.mjs:2 — `import { execFileSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmve8d4rx0f70ad07xzgk5tuh","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/media-contract.test.mjs:7 — `import { spawnSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmve8d4rx0f71ad078p2wpuen","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/transitions.test.mjs:2 — `import { spawnSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmve8d4rx0f72ad07nlrkslrd","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE"},{"id":"cmve8d4rx0f73ad07wuz73xl1","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.mjs:54 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmve8d4rx0f74ad075ksgjvz1","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.mjs:84 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmve8d4rx0f75ad07px4f6sxv","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.mjs:100 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmve8d4ry0f76ad07vykwx1gf","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.test.mjs:5 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmve8d4ry0f77ad07ljg1nmkn","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.test.mjs:10 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmve8d4ry0f78ad07r8hdgmws","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.test.mjs:11 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmve8d4ry0f79ad07d50j5a0m","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.test.mjs:32 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmve8d4ry0f7aad07l5e2ao8g","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.test.mjs:94 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmve8d4ry0f7bad07sdg2fka6","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.test.mjs:120 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmve8d4ry0f7cad07z1gttr47","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/audio.mjs:23 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmve8d4ry0f7dad07jn50hl8b","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/audio.mjs:86 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmve8d4ry0f7ead07fwclavdq","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/audio.test.mjs:5 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmve8d4ry0f7fad07gh9qtb8q","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/audio.test.mjs:24 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmve8d4ry0f7gad075wln256f","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/audio.test.mjs:96 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmve8d4ry0f7had076jsvllwi","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/audio.test.mjs:192 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmve8d4ry0f7iad07145ffset","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/audio.test.mjs:325 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmve8d4ry0f7jad071oeou9d0","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/audio.test.mjs:349 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmve8d4ry0f7kad07pgypglss","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/build-frame-colors.test.mjs:2 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmve8d4ry0f7lad07cb8qs823","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/build-frame-colors.test.mjs:35 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmve8d4ry0f7mad07o02cf8qi","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/build-frame-subsets.test.mjs:2 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmve8d4ry0f7nad07cyk4vjiz","source":"cisco","category":"security","label":"Script contacts a destination the documentation never mentions","detail":"scripts/captions.mjs:483 — Script contacts or configures 'cdn.jsdelivr.net' but the skill documentation never visibly mentions it. Undocumented network destinations can indicate behaviour the manifest and description do not disclose.","severity":"low","ruleId":"UNDECLARED_NETWORK_DESTINATION"},{"id":"cmve8d4ry0f7oad07ca7wc758","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/media-contract.test.mjs:7 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmve8d4ry0f7pad07se3crguh","source":"cisco","category":"security","label":"INJECTION ATTACK detected by YARA","detail":"scripts/media-contract.test.mjs:29 — Script injection patterns: onerror=\"alert(","severity":"critical","ruleId":"YARA_script_injection_generic"},{"id":"cmve8d4ry0f7qad07swg6hlsh","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/media-contract.test.mjs:32 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmve8d4ry0f7rad07ntl7ffjl","source":"cisco","category":"security","label":"INJECTION ATTACK detected by YARA","detail":"scripts/media-contract.test.mjs:70 — Script injection patterns: onerror=\"alert(","severity":"critical","ruleId":"YARA_script_injection_generic"},{"id":"cmve8d4ry0f7sad072pygpghx","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/media-contract.test.mjs:73 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmve8d4ry0f7tad07kfp88swx","source":"cisco","category":"security","label":"INJECTION ATTACK detected by YARA","detail":"scripts/media-contract.test.mjs:102 — Script injection patterns: ","author":"","version":"","license":"Apache-2.0","overallGrade":"C","badgeStatus":"conditional","publishedAt":"2026-08-05T22:05:42.346Z","sourceUrl":"https://github.com/heygen-com/hyperframes/tree/main/skills/hyperframes-cli","findings":[{"id":"cmvflqe1l0ma7ad07fa05c3up","source":"vettd","category":"security","label":"Cloud credential file access","detail":"Detected in references/lambda.md:35 — `- AWS credentials configured (env vars, `~/.aws/credentials`, SSO, or IMDS).`","severity":"medium","ruleId":"VTD-0005"},{"id":"cmvflqe1l0ma8ad07cb4cdeve","source":"vettd","category":"security","label":"References external URL — review for indirect prompt injection risk","detail":"External URL(s) detected in SKILL.md — referenced content can change after audit","severity":"medium","ruleId":"VTD-0088"},{"id":"cmvflqe1l0ma9ad07xaqbsb8l","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE"},{"id":"cmvflqe1l0maaad07sw70mcvs","source":"cisco","category":"security","label":"Active instruction acquires and executes remote content","detail":"SKILL.md:95 — SKILL.md contains an operative statement that explicitly coordinates remote content acquisition with execution.","severity":"high","ruleId":"ACTIVE_REMOTE_ACQUIRE_EXECUTE"}],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":"B","criticalCount":0,"highCount":0},{"source":"cisco","status":"success","verdict":null,"grade":"C","criticalCount":0,"highCount":1}],"freshness":{"status":"verified_unchanged","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-21T18:39:41.312Z","lastVerifiedAt":"2026-10-21T18:39:41.312Z","lastChangeDetectedAt":"2026-10-19T18:37:42.579Z","scannedHash":"6386daeb43e830f6a346edd72398869fac235fc6","latestUpstreamHash":"6386daeb43e830f6a346edd72398869fac235fc6","nextCheckDueAt":"2026-10-22T20:11:24.796Z"}},{"id":"cmvis1rkq1jttad0705mnjef1","slug":"hyperframes","publicId":"b6683cdc-78c4-4c34-b53f-52f778abd48f","name":"hyperframes","description":"Read first to make, edit, animate or render any video with HyperFrames (HTML rendered to video), including launch films, explainers, music videos, charts, maps, vertical clips, title cards, captions and overlays. Holds the render contract, the work loop and what each kind of video needs.","author":"","version":"","license":"Apache-2.0","overallGrade":"F","badgeStatus":"flagged","publishedAt":"2026-08-05T22:05:41.633Z","sourceUrl":"https://github.com/heygen-com/hyperframes/tree/main/skills/hyperframes","findings":[{"id":"cmvis1rkq1jtuad07cuqkwvdn","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/bake-basemap.mjs:26 — `import { spawnSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmvis1rkq1jtvad07mwhz0cld","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/lib/main-module.test.mjs:4 — `import { spawnSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmvis1rkq1jtwad0792xloex2","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/locate.mjs:23 — `import { execFileSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmvis1rkq1jtxad075qk3wyzv","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/plugin-cli.mjs:3 — `import { spawnSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmvis1rkq1jtyad07wlj9ceoa","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/plugin-cli.test.mjs:2 — `import { spawnSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmvis1rkq1jtzad07uj5f7zu7","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE"},{"id":"cmvis1rkq1ju0ad07hqq1mxkl","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/bake-basemap.mjs:26 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvis1rkq1ju1ad077nfidkuh","source":"cisco","category":"security","label":"Script contacts a destination the documentation never mentions","detail":"scripts/bake-basemap.mjs:127 — Script contacts or configures 'server.arcgisonline.com' but the skill documentation never visibly mentions it. Undocumented network destinations can indicate behaviour the manifest and description do not disclose.","severity":"low","ruleId":"UNDECLARED_NETWORK_DESTINATION"},{"id":"cmvis1rkq1ju2ad073u815atr","source":"cisco","category":"security","label":"Script contacts a destination the documentation never mentions","detail":"scripts/bake-basemap.mjs:128 — Script contacts or configures 'a.basemaps.cartocdn.com' but the skill documentation never visibly mentions it. Undocumented network destinations can indicate behaviour the manifest and description do not disclose.","severity":"low","ruleId":"UNDECLARED_NETWORK_DESTINATION"},{"id":"cmvis1rkq1ju3ad07l1osm0rv","source":"cisco","category":"security","label":"Script contacts a destination the documentation never mentions","detail":"scripts/bake-basemap.mjs:149 — Script contacts or configures 'cdn.jsdelivr.net' but the skill documentation never visibly mentions it. Undocumented network destinations can indicate behaviour the manifest and description do not disclose.","severity":"low","ruleId":"UNDECLARED_NETWORK_DESTINATION"},{"id":"cmvis1rkq1ju4ad07vlpdl9bf","source":"cisco","category":"security","label":"Outbound network request primitives in JavaScript/TypeScript","detail":"scripts/bake-basemap.mjs:196 — Pattern detected: fetch(","severity":"medium","ruleId":"DATA_EXFIL_JS_NETWORK"},{"id":"cmvis1rkq1ju5ad07ccj1kxi4","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/bake-basemap.mjs:280 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvis1rkq1ju6ad07ivdtk2w9","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/lib/main-module.test.mjs:4 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvis1rkq1ju7ad075hgffo44","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/lib/main-module.test.mjs:18 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvis1rkr1ju8ad07gwr0nlpg","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/locate.mjs:23 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvis1rkr1ju9ad07848zf8ee","source":"cisco","category":"security","label":"Outbound network request primitives in JavaScript/TypeScript","detail":"scripts/locate.mjs:215 — Pattern detected: fetch(","severity":"medium","ruleId":"DATA_EXFIL_JS_NETWORK"},{"id":"cmvis1rkr1juaad07dptl4hyh","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/plugin-cli.mjs:3 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvis1rkr1jubad07e5hmv5dz","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/plugin-cli.mjs:78 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvis1rkr1jucad07hexhvhig","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/plugin-cli.test.mjs:2 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvis1rkr1judad07hi4as43x","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/plugin-cli.test.mjs:108 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"}],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":"F","criticalCount":5,"highCount":5},{"source":"cisco","status":"success","verdict":null,"grade":"F","criticalCount":9,"highCount":9}],"freshness":{"status":"verified_unchanged","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-22T00:02:45.723Z","lastVerifiedAt":"2026-10-22T00:02:45.723Z","lastChangeDetectedAt":"2026-10-21T23:58:06.923Z","scannedHash":"a650bb04800097a6492bd1dce4415f89fe5cf1b6","latestUpstreamHash":"a650bb04800097a6492bd1dce4415f89fe5cf1b6","nextCheckDueAt":"2026-10-23T02:24:31.237Z"}},{"id":"cmuxm3cpe25ukad07vt29rtem","slug":"oversized-cursor","publicId":"f630dcee-e1e7-4652-bebd-3eabcb87c7ac","name":"oversized-cursor","description":"House-style oversized macOS cursor technique for HyperFrames launch videos. Load whenever a scene involves cursors or a pointer-led action, when kicking off a UI scene, when igniting a morph/transition/typing run with a click, or when a scene reads as static, dead, or stale and needs a cheap high-yield source of motion to carry the viewer's eye and segment them out of the stale state. Covers cursor size/look (incl. brand-motif cursors), the off-screen entry law, tip-targeting and the click tap, click-ignites-the-next-beat, and exit / cross-scene handoff.","author":"","version":"","license":"Apache-2.0","overallGrade":"A","badgeStatus":"vettd","publishedAt":"2026-08-05T22:05:40.841Z","sourceUrl":"https://github.com/heygen-com/hyperframes/tree/main/.claude/skills/oversized-cursor","findings":[{"id":"cmuxm3cpe25ulad07q99ry92m","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE"}],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":"A","criticalCount":0,"highCount":0},{"source":"cisco","status":"success","verdict":null,"grade":"A","criticalCount":0,"highCount":0}],"freshness":{"status":"verified_unchanged","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-21T15:48:40.995Z","lastVerifiedAt":"2026-10-21T15:48:40.995Z","lastChangeDetectedAt":"2026-10-09T09:26:29.299Z","scannedHash":"c80093ecaeff39dd228af5c4b3dd526baa8fca87","latestUpstreamHash":"c80093ecaeff39dd228af5c4b3dd526baa8fca87","nextCheckDueAt":"2026-10-22T17:43:24.231Z"}},{"id":"cmuxk5f961qvnad07cnc6fw6r","slug":"motion-doctrine","publicId":"2eefe483-410f-41a0-9b7f-28fda85563ee","name":"motion-doctrine","description":"GATEWAY — load FIRST before composing any HyperFrames animation or video. The high-level motion law that makes a multi-scene video feel like ONE continuous camera move instead of a stack of independently-animated slides. Covers the vector law (how you exit determines how you enter, incl. the Z scale-sign rule), the film's current, carrier elements, causal motion, the Seam Gate (build-gate enforcement), the ban on idle wobble (motion must PERFORM, not breathe), stillness-before-climax, and the sustained-motion routes. Routes to the low-level technique skills (cut-the-curve — the full catalog incl. waterfall entry + nudge curve, oversized-cursor, seam-craft). These rules SUPERSEDE generic / upstream motion guidance. [continuity, direction, vector, momentum, seam, transition, ease, performance, idle-motion, narrative-motion, film-grammar]","author":"","version":"","license":"Apache-2.0","overallGrade":"F","badgeStatus":"flagged","publishedAt":"2026-08-05T22:05:40.729Z","sourceUrl":"https://github.com/heygen-com/hyperframes/tree/main/.claude/skills/motion-doctrine","findings":[{"id":"cmuxk5f971qvoad07z8gr4lte","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/seam-gate.mjs:14 — `import { spawn } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmuxk5f971qvpad0760st081y","source":"vettd","category":"security","label":"References external URL — review for indirect prompt injection risk","detail":"External URL(s) detected in references/seam-gate.md — referenced content can change after audit","severity":"medium","ruleId":"VTD-0088"},{"id":"cmuxk5f971qvqad07guciff71","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE"},{"id":"cmuxk5f971qvrad07uhyeq4m1","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/seam-gate.mjs:14 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmuxk5f971qvsad07ce5qm923","source":"cisco","category":"security","label":"Outbound network request primitives in JavaScript/TypeScript","detail":"scripts/seam-gate.mjs:59 — Pattern detected: fetch(","severity":"medium","ruleId":"DATA_EXFIL_JS_NETWORK"},{"id":"cmuxk5f971qvtad07qod26p8j","source":"cisco","category":"security","label":"Outbound network request primitives in JavaScript/TypeScript","detail":"scripts/seam-gate.mjs:122 — Pattern detected: fetch(","severity":"medium","ruleId":"DATA_EXFIL_JS_NETWORK"}],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":"F","criticalCount":1,"highCount":1},{"source":"cisco","status":"success","verdict":null,"grade":"F","criticalCount":1,"highCount":1}],"freshness":{"status":"verified_unchanged","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-22T01:22:39.428Z","lastVerifiedAt":"2026-10-22T01:22:39.428Z","lastChangeDetectedAt":"2026-10-09T07:58:29.165Z","scannedHash":"f2a2a37ab0ab9d38a18ed32877976e9c1142cb23","latestUpstreamHash":"f2a2a37ab0ab9d38a18ed32877976e9c1142cb23","nextCheckDueAt":"2026-10-23T03:00:58.733Z"}},{"id":"cmvikxpo61ih0ad07bgsyely4","slug":"hyperframes-registry","publicId":"a9c1d0b0-acad-41d6-a3fd-b53642299ba2","name":"hyperframes-registry","description":"About 450 ready-made HyperFrames blocks and components installed as editable source - transitions, overlays, titles, kinetic type, captions, charts, map overlays, 3D, camera moves. Use it before hand-building any named visual (CRT scanlines, glitch, film grain, a chart); also for hyperframes add and catalog.","author":"","version":"","license":"Apache-2.0","overallGrade":"B","badgeStatus":"conditional","publishedAt":"2026-08-05T22:05:40.441Z","sourceUrl":"https://github.com/heygen-com/hyperframes/tree/main/skills/hyperframes-registry","findings":[{"id":"cmvikxpo61ih1ad070ys782d9","source":"vettd","category":"security","label":"References external URL — review for indirect prompt injection risk","detail":"External URL(s) detected in references/contributing.md — referenced content can change after audit","severity":"medium","ruleId":"VTD-0088"},{"id":"cmvikxpo61ih2ad070e06vefo","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE"}],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":"B","criticalCount":0,"highCount":0},{"source":"cisco","status":"success","verdict":null,"grade":"A","criticalCount":0,"highCount":0}],"freshness":{"status":"verified_unchanged","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-21T20:43:39.220Z","lastVerifiedAt":"2026-10-21T20:43:39.220Z","lastChangeDetectedAt":"2026-10-21T20:42:21.917Z","scannedHash":"ca95458584add658afa2a9eaa986795949970103","latestUpstreamHash":"ca95458584add658afa2a9eaa986795949970103","nextCheckDueAt":"2026-10-22T22:51:33.550Z"}},{"id":"cmvj29ez01ln0ad075st3l853","slug":"captions-overlay","publicId":"86718bdf-8ada-4651-b311-3da91a0e2906","name":"captions-overlay","description":"Overlay doctrine for captions in HyperFrames videos — the caption MODEL (drop / rail / embed) and the rule that captions are an OVERLAY composited on top of the film, never a reserved bottom band you shift content up to avoid. Load when adding captions/subtitles to a talking-head or launch video, when deciding whether a phrase should be dropped, ride the verbatim rail, or be promoted to a scarce embedded climax, when laying out a composition that will carry captions (do NOT reserve a keep-out band), or when centering a composition on the true frame center under captions. Applies ON TOP of the `/hyperframes` skill's references/captions.md.","author":"","version":"","license":"Apache-2.0","overallGrade":"A","badgeStatus":"vettd","publishedAt":"2026-08-05T22:05:38.032Z","sourceUrl":"https://github.com/heygen-com/hyperframes/tree/main/.claude/skills/captions-overlay","findings":[{"id":"cmvj29ez01ln1ad07xopcj5yf","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE"}],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":"A","criticalCount":0,"highCount":0},{"source":"cisco","status":"success","verdict":null,"grade":"A","criticalCount":0,"highCount":0}],"freshness":{"status":"verified_unchanged","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-22T04:48:38.720Z","lastVerifiedAt":"2026-10-22T04:48:38.720Z","lastChangeDetectedAt":"2026-10-22T04:47:39.643Z","scannedHash":"bf094eb4f2a11c624be57970439a8da0331882c8","latestUpstreamHash":"bf094eb4f2a11c624be57970439a8da0331882c8","nextCheckDueAt":"2026-10-23T04:32:07.230Z"}},{"id":"cmuxm1x3922p7ad07itw540e5","slug":"oversized-cursor","publicId":"dc0a4ad0-2000-4c81-92ff-575f8db05993","name":"oversized-cursor","description":"House-style oversized macOS cursor technique for HyperFrames launch videos. Load whenever a scene involves cursors or a pointer-led action, when kicking off a UI scene, when igniting a morph/transition/typing run with a click, or when a scene reads as static, dead, or stale and needs a cheap high-yield source of motion to carry the viewer's eye and segment them out of the stale state. Covers cursor size/look (incl. brand-motif cursors), the off-screen entry law, tip-targeting and the click tap, click-ignites-the-next-beat, and exit / cross-scene handoff.","author":"","version":"","license":"Apache-2.0","overallGrade":"A","badgeStatus":"vettd","publishedAt":"2026-08-05T22:05:38.031Z","sourceUrl":"https://github.com/heygen-com/hyperframes/tree/main/.agents/skills/oversized-cursor","findings":[{"id":"cmuxm1x3922p8ad07ry649f2m","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE"}],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":"A","criticalCount":0,"highCount":0},{"source":"cisco","status":"success","verdict":null,"grade":"A","criticalCount":0,"highCount":0}],"freshness":{"status":"verified_unchanged","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-22T03:03:39.537Z","lastVerifiedAt":"2026-10-22T03:03:39.537Z","lastChangeDetectedAt":"2026-10-09T06:56:29.046Z","scannedHash":"c80093ecaeff39dd228af5c4b3dd526baa8fca87","latestUpstreamHash":"c80093ecaeff39dd228af5c4b3dd526baa8fca87","nextCheckDueAt":"2026-10-23T01:13:04.683Z"}},{"id":"cmuxihewx0l3zad074eeywyph","slug":"hyperframes-keyframes","publicId":"829f84c8-3ac7-42f5-9833-442cc072be9c","name":"hyperframes-keyframes","description":">","author":"","version":"","license":"Apache-2.0","overallGrade":"B","badgeStatus":"conditional","publishedAt":"2026-08-05T22:05:37.547Z","sourceUrl":"https://github.com/heygen-com/hyperframes/tree/main/skills/hyperframes-keyframes","findings":[{"id":"cmuxihewx0l40ad07za679rh0","source":"vettd","category":"security","label":"References external URL — review for indirect prompt injection risk","detail":"External URL(s) detected in references/keyframe-patterns.md — referenced content can change after audit","severity":"medium","ruleId":"VTD-0088"},{"id":"cmuxihewx0l41ad07b45hx81a","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE"}],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":"B","criticalCount":0,"highCount":0},{"source":"cisco","status":"success","verdict":null,"grade":"A","criticalCount":0,"highCount":0}],"freshness":{"status":"unreachable","reason":"ref_not_found","retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-22T00:49:07.019Z","lastVerifiedAt":"2026-10-21T00:33:07.936Z","lastChangeDetectedAt":"2026-10-09T10:23:29.394Z","scannedHash":"3f631bbe5e46e487c9d73af4cbc60a0cc4f48cd3","latestUpstreamHash":"3f631bbe5e46e487c9d73af4cbc60a0cc4f48cd3","nextCheckDueAt":"2026-10-29T00:49:07.019Z"}},{"id":"cmuxm1wg022j5ad077e0755l9","slug":"changelog-video","publicId":"ade328b4-9e57-4b33-89f7-67087733b8e1","name":"changelog-video","description":"Turn a weekly changelog .md into a finished branded changelog video (square 1080, ~45-60s, Annie VO, animated brand background, mock-UI visualizations, lowkey captions). Use when the user provides a changelog/digest markdown and wants the weekly video, or says \"changelog video\". Self-contained — fonts, background, lexicon, and scripts ship in this skill.","author":"","version":"","license":"Apache-2.0","overallGrade":"B","badgeStatus":"vettd","publishedAt":"2026-08-05T22:05:37.546Z","sourceUrl":"https://github.com/heygen-com/hyperframes/tree/main/.claude/skills/changelog-video","findings":[{"id":"cmuxm1wg022j6ad07sjqfhbt5","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE"},{"id":"cmuxm1wg022j7ad07g0subhq4","source":"cisco","category":"security","label":"File extension does not match actual content type","detail":"assets/bg-pattern.mp4 — File 'bg-pattern.mp4' extension (.mp4, expected video) does not match its actual content type (Open Neural Network Exchange, archive).","severity":"medium","ruleId":"FILE_MAGIC_MISMATCH"}],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":"A","criticalCount":0,"highCount":0},{"source":"cisco","status":"success","verdict":null,"grade":"B","criticalCount":0,"highCount":0}],"freshness":{"status":"verified_unchanged","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-21T19:21:41.444Z","lastVerifiedAt":"2026-10-21T19:21:41.444Z","lastChangeDetectedAt":"2026-10-09T07:43:29.132Z","scannedHash":"322c187293490c60d02fa27876da2c1c80aa3fef","latestUpstreamHash":"322c187293490c60d02fa27876da2c1c80aa3fef","nextCheckDueAt":"2026-10-22T20:52:33.177Z"}},{"id":"cmvimfpsb1iread07otyd5s8d","slug":"captions-overlay","publicId":"4a35a2c4-e3f1-488e-95cf-94207389a510","name":"captions-overlay","description":"Overlay doctrine for captions in HyperFrames videos — the caption MODEL (drop / rail / embed) and the rule that captions are an OVERLAY composited on top of the film, never a reserved bottom band you shift content up to avoid. Load when adding captions/subtitles to a talking-head or launch video, when deciding whether a phrase should be dropped, ride the verbatim rail, or be promoted to a scarce embedded climax, when laying out a composition that will carry captions (do NOT reserve a keep-out band), or when centering a composition on the true frame center under captions. Applies ON TOP of the `/hyperframes` skill's references/captions.md.","author":"","version":"","license":"Apache-2.0","overallGrade":"A","badgeStatus":"vettd","publishedAt":"2026-08-05T22:05:35.543Z","sourceUrl":"https://github.com/heygen-com/hyperframes/tree/main/.agents/skills/captions-overlay","findings":[{"id":"cmvimfpsb1irfad07936bf53x","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE"}],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":"A","criticalCount":0,"highCount":0},{"source":"cisco","status":"success","verdict":null,"grade":"A","criticalCount":0,"highCount":0}],"freshness":{"status":"verified_unchanged","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-21T23:41:37.435Z","lastVerifiedAt":"2026-10-21T23:41:37.435Z","lastChangeDetectedAt":"2026-10-21T23:41:06.891Z","scannedHash":"bf094eb4f2a11c624be57970439a8da0331882c8","latestUpstreamHash":"bf094eb4f2a11c624be57970439a8da0331882c8","nextCheckDueAt":"2026-10-23T01:50:29.713Z"}},{"id":"cmuxm3cx225w5ad07i3pyb2rv","slug":"seam-craft","publicId":"05f3072a-8b4e-4c93-add2-f2e11ee777f2","name":"seam-craft","description":"Render-correctness doctrine for scene-to-scene seams in HyperFrames launch videos — the prerequisites that make transitions composite correctly on the master timeline. Load when assembling the master timeline / index.html, when a white flash appears at a cut or crossfade seam (especially on dark films), when reasoning about why a transition opacity dip shows through, or when verifying the render-side mechanics of how overlapping scene wrappers blend. Covers the opaque stage-ground (#root background) white-flash guard and how the injector overlaps wrappers, holds final frames, ping-pongs tracks, and stamps lint-clean template code onto the master timeline. Does NOT contain the per-transition catalog — see the transition registry for individual transition entries.","author":"","version":"","license":"Apache-2.0","overallGrade":"A","badgeStatus":"vettd","publishedAt":"2026-08-05T22:05:35.141Z","sourceUrl":"https://github.com/heygen-com/hyperframes/tree/main/.claude/skills/seam-craft","findings":[{"id":"cmuxm3cx225w6ad07i4u41fag","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE"}],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":"A","criticalCount":0,"highCount":0},{"source":"cisco","status":"success","verdict":null,"grade":"A","criticalCount":0,"highCount":0}],"freshness":{"status":"verified_unchanged","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-21T10:14:39.064Z","lastVerifiedAt":"2026-10-21T10:14:39.064Z","lastChangeDetectedAt":"2026-10-08T10:07:35.605Z","scannedHash":"c7d92e248a42c60118f91c02a56c3695c4a0c998","latestUpstreamHash":"c7d92e248a42c60118f91c02a56c3695c4a0c998","nextCheckDueAt":"2026-10-22T12:12:12.391Z"}},{"id":"cmv74f2pae1e6ad06xl3ofn2a","slug":"talking-head-recut","publicId":"b5588d91-aa67-40c4-ba17-9e0b1f53f17d","name":"talking-head-recut","description":"Package an existing talking-head / interview / podcast video with timed, designed GRAPHIC OVERLAY cards — kinetic titles, lower-thirds, data callouts, quotes, side panels, picture-in-picture — synced to the transcript, on a 16:9 / 9:16 / 4:5 canvas of your choice; the clip plays untouched underneath. Trigger on \"graphic overlays\", \"on-screen graphics\", \"package / dress up my video\". Not plain subtitles (/embedded-captions). Unclear → /hyperframes.","author":"","version":"","license":"Apache-2.0","overallGrade":"A","badgeStatus":"vettd","publishedAt":"2026-08-05T22:05:24.466Z","sourceUrl":"https://github.com/heygen-com/hyperframes/tree/main/skills/talking-head-recut","findings":[{"id":"cmv74f2pae1e7ad06rey13wtj","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE"},{"id":"cmv74f2pae1e8ad066tbbzj3n","source":"cisco","category":"security","label":"Script contacts a destination the documentation never mentions","detail":"assets/vendor/gsap.min.js:10 — Script contacts or configures 'gsap.com' but the skill documentation never visibly mentions it. Undocumented network destinations can indicate behaviour the manifest and description do not disclose.","severity":"low","ruleId":"UNDECLARED_NETWORK_DESTINATION"}],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":"A","criticalCount":0,"highCount":0},{"source":"cisco","status":"success","verdict":null,"grade":"A","criticalCount":0,"highCount":0}],"freshness":{"status":"unreachable","reason":"ref_not_found","retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-21T22:24:01.665Z","lastVerifiedAt":"2026-10-20T22:21:48.098Z","lastChangeDetectedAt":"2026-10-13T20:15:36.412Z","scannedHash":"75c87dc69aabf334e1ce771e6b7acf147cb163ad","latestUpstreamHash":"75c87dc69aabf334e1ce771e6b7acf147cb163ad","nextCheckDueAt":"2026-10-28T22:24:01.665Z"}},{"id":"cmve72t100f05ad07dzp24gj0","slug":"slideshow","publicId":"2a85f188-2a5d-4950-b5ea-41f437bef3bc","name":"slideshow","description":">","author":"","version":"","license":"Apache-2.0","overallGrade":"B","badgeStatus":"conditional","publishedAt":"2026-08-05T22:05:18.141Z","sourceUrl":"https://github.com/heygen-com/hyperframes/tree/main/skills/slideshow","findings":[{"id":"cmve72t110f06ad07emqcsmei","source":"vettd","category":"security","label":"References external URL — review for indirect prompt injection risk","detail":"External URL(s) detected in references/standalone-harness.md — referenced content can change after audit","severity":"medium","ruleId":"VTD-0088"},{"id":"cmve72t110f07ad071euas5k4","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE"}],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":"B","criticalCount":0,"highCount":0},{"source":"cisco","status":"success","verdict":null,"grade":"A","criticalCount":0,"highCount":0}],"freshness":{"status":"verified_unchanged","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-21T15:49:40.995Z","lastVerifiedAt":"2026-10-21T15:49:40.995Z","lastChangeDetectedAt":"2026-10-18T19:04:11.843Z","scannedHash":"f2328ac8524e0d0f19f39b01e7d891c4e6d5a19e","latestUpstreamHash":"f2328ac8524e0d0f19f39b01e7d891c4e6d5a19e","nextCheckDueAt":"2026-10-22T17:54:34.285Z"}},{"id":"cmveeni280g0oad07f7ewv34v","slug":"pr-to-video","publicId":"5410f505-89fc-42bb-b77a-38d35bce7ff4","name":"pr-to-video","description":"Turn a GitHub pull request (a PR URL, owner/repo#N, or 'this PR' in a checked-out repo) into a code-change explainer video — changelog, feature reveal, fix, or refactor walkthrough built from the diff, commits, and files: the input is a code change, not a website. Not a product promo (/product-launch-video) or a no-PR topic explainer (/faceless-explainer). Unclear → /hyperframes.","author":"","version":"","license":"Apache-2.0","overallGrade":"F","badgeStatus":"flagged","publishedAt":"2026-08-05T22:05:18.044Z","sourceUrl":"https://github.com/heygen-com/hyperframes/tree/main/skills/pr-to-video","findings":[{"id":"cmveeni280g0pad07o0pcd1sf","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/assemble-index.mjs:54 — `import { spawnSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmveeni280g0qad07nb44j9uq","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/assemble-index.test.mjs:5 — `import { spawnSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmveeni280g0rad07r8b7eymp","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/audio.mjs:25 — `import { spawnSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmveeni280g0sad070ktmaqvo","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/captions.test.mjs:2 — `import { execFileSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmveeni280g0tad0787k3002h","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/fetch-pr.mjs:28 — `import { execFileSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmveeni280g0uad071h251ndm","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/frame-contract.test.mjs:2 — `import { execFileSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmveeni280g0vad0733pfnevi","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/preflight.mjs:3 — `import { spawnSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmveeni280g0wad070opdtqbi","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE"},{"id":"cmveeni280g0xad074elakltr","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.mjs:54 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmveeni280g0yad07c5n0okwm","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.mjs:85 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmveeni280g0zad07503ccv2g","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.mjs:101 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmveeni280g10ad07eqz00nwr","source":"cisco","category":"security","label":"Script contacts a destination the documentation never mentions","detail":"scripts/assemble-index.mjs:587 — Script contacts or configures 'cdn.jsdelivr.net' but the skill documentation never visibly mentions it. Undocumented network destinations can indicate behaviour the manifest and description do not disclose.","severity":"low","ruleId":"UNDECLARED_NETWORK_DESTINATION"},{"id":"cmveeni280g11ad07p9zarmnb","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.test.mjs:5 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmveeni280g12ad07r08tj8ib","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.test.mjs:10 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmveeni290g13ad07vlo5uu6k","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.test.mjs:11 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmveeni290g14ad07g4rjxod8","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.test.mjs:35 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmveeni290g15ad07dqtp2nql","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.test.mjs:97 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmveeni290g16ad07ovhrjq3c","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.test.mjs:123 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmveeni290g17ad07q78gmuun","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/audio.mjs:25 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmveeni290g18ad07jovtejha","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/audio.mjs:88 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmveeni290g19ad07ysofkrz7","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/captions.test.mjs:2 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmveeni290g1aad07exhleue8","source":"cisco","category":"security","label":"INJECTION ATTACK detected by YARA","detail":"scripts/captions.test.mjs:226 — Script injection patterns: onerror=\"alert(","severity":"critical","ruleId":"YARA_script_injection_generic"},{"id":"cmveeni290g1bad07ptvryl2a","source":"cisco","category":"security","label":"Outbound network request primitives in JavaScript/TypeScript","detail":"scripts/fetch-people-avatars.mjs:114 — Pattern detected: fetch(","severity":"medium","ruleId":"DATA_EXFIL_JS_NETWORK"},{"id":"cmveeni290g1cad07jrkvhjgl","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/fetch-pr.mjs:28 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmveeni290g1dad07i459fd7b","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/frame-contract.test.mjs:2 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmveeni290g1ead07gty45muf","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/preflight.mjs:3 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"}],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":"F","criticalCount":7,"highCount":7},{"source":"cisco","status":"success","verdict":null,"grade":"F","criticalCount":16,"highCount":16}],"freshness":{"status":"unreachable","reason":"ref_not_found","retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-21T21:38:22.016Z","lastVerifiedAt":"2026-10-20T22:08:48.097Z","lastChangeDetectedAt":"2026-10-18T22:35:03.556Z","scannedHash":"01e34d507b8c0502dcdc81d7a3b1ba6ef34cad84","latestUpstreamHash":"01e34d507b8c0502dcdc81d7a3b1ba6ef34cad84","nextCheckDueAt":"2026-10-28T21:38:22.016Z"}},{"id":"cmvelnjah0h5yad07n6u5xnyg","slug":"faceless-explainer","publicId":"c592d165-8db4-4810-866a-61c1e4b30f33","name":"faceless-explainer","description":"Turn arbitrary text — an article, notes, a topic, a brief — into a faceless explainer video: there is no site or footage to capture, so the visuals are invented per scene (typography, abstract graphics, diagrams, data-viz). Use for topic explainers, concept breakdowns, how-tos, listicles. Not a video built from a website (/product-launch-video — promo or tour). Unclear → /hyperframes.","author":"","version":"","license":"Apache-2.0","overallGrade":"F","badgeStatus":"flagged","publishedAt":"2026-08-05T22:05:18.041Z","sourceUrl":"https://github.com/heygen-com/hyperframes/tree/main/skills/faceless-explainer","findings":[{"id":"cmvelnjah0h5zad07pd4siiwf","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/assemble-index.mjs:54 — `import { spawnSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmvelnjah0h60ad07z60z6lar","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/assemble-index.test.mjs:5 — `import { spawnSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmvelnjah0h61ad0779itduqj","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/audio.mjs:25 — `import { spawnSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmvelnjah0h62ad07p81cn06h","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/audio.test.mjs:5 — `import { spawnSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmvelnjah0h63ad07n6geskui","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/transitions.test.mjs:5 — `import { spawnSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmvelnjah0h64ad07hm9sgwlm","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE"},{"id":"cmvelnjah0h65ad07nnnbf608","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.mjs:54 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvelnjah0h66ad07xsj02jfp","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.mjs:84 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvelnjah0h67ad07q2cdru7u","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.mjs:100 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvelnjah0h68ad07ikx2zat7","source":"cisco","category":"security","label":"Script contacts a destination the documentation never mentions","detail":"scripts/assemble-index.mjs:581 — Script contacts or configures 'cdn.jsdelivr.net' but the skill documentation never visibly mentions it. Undocumented network destinations can indicate behaviour the manifest and description do not disclose.","severity":"low","ruleId":"UNDECLARED_NETWORK_DESTINATION"},{"id":"cmvelnjah0h69ad07z36wpcaz","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.test.mjs:5 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvelnjai0h6aad07m2qc2pjc","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.test.mjs:10 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvelnjai0h6bad07e00drxrd","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.test.mjs:11 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvelnjai0h6cad073h6djnlt","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.test.mjs:32 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvelnjai0h6dad07d0k7cuou","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.test.mjs:94 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvelnjai0h6ead07c8wwysyo","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/assemble-index.test.mjs:120 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvelnjai0h6fad075cs4afyb","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/audio.mjs:25 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvelnjai0h6gad07xjfjamut","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/audio.mjs:88 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvelnjai0h6had07e949zsyi","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/audio.test.mjs:5 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvelnjai0h6iad07zvvm0scg","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/audio.test.mjs:53 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvelnjai0h6jad078q50i500","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/audio.test.mjs:134 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvelnjai0h6kad074yixbh9b","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/audio.test.mjs:267 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvelnjai0h6lad07o88baa5s","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/audio.test.mjs:291 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvelnjai0h6mad07qm3ze4cu","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/transitions.test.mjs:5 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmvelnjai0h6nad07cymley5c","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/transitions.test.mjs:58 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"}],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":"F","criticalCount":5,"highCount":5},{"source":"cisco","status":"success","verdict":null,"grade":"F","criticalCount":18,"highCount":18}],"freshness":{"status":"unreachable","reason":"ref_not_found","retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-22T02:19:39.493Z","lastVerifiedAt":"2026-10-21T04:38:13.395Z","lastChangeDetectedAt":"2026-10-19T01:47:35.054Z","scannedHash":"43a49f7ff976951ff456975b6316172682f89cd0","latestUpstreamHash":"43a49f7ff976951ff456975b6316172682f89cd0","nextCheckDueAt":"2026-10-29T02:19:39.493Z"}},{"id":"cmuxm1x7t22q2ad07zxmxhuh0","slug":"cut-the-curve","publicId":"3fcc61e6-350a-463c-b624-9d9a563c362b","name":"cut-the-curve","description":"The technique catalog: five velocity-matched SEAMS (zoom-through, INVERSE zoom-through, cut-the-curve, waterfall cut, rack-focus blur-cut) plus the two in-scene techniques — waterfall ENTRY (staggered arrival cascades for title cards / segment openers) and the nudge curve (slow-fast-slow three-phase group slides). Covers partial-travel (~12% of frame) velocity matching via mirrored power4 eases, the Z scale-sign rule, size-scaled blur (10px text / 18-20px full-frame), word-by-word staggered cuts, cascade pacing by element weight, and the 10/65/25 slide ratio. Read before authoring any transition, text-beat handoff, kinetic text entry, or group reposition. [depth, zoom, inverse-zoom, scale-sign, mirrored-zoom, rack-focus, pacing, velocity, cut-the-curve, waterfall, stagger, cascade, kinetic-text, title-card, segment-opener, nudge, slide, easing, group-motion, z-depth, motion-graphics, cinematic, transition, blur, directional-continuity]","author":"","version":"","license":"Apache-2.0","overallGrade":"A","badgeStatus":"vettd","publishedAt":"2026-08-05T22:05:13.538Z","sourceUrl":"https://github.com/heygen-com/hyperframes/tree/main/.agents/skills/cut-the-curve","findings":[{"id":"cmuxm1x7t22q3ad07ucwgm816","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE"}],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":"A","criticalCount":0,"highCount":0},{"source":"cisco","status":"success","verdict":null,"grade":"A","criticalCount":0,"highCount":0}],"freshness":{"status":"verified_unchanged","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-22T00:06:06.947Z","lastVerifiedAt":"2026-10-22T00:06:06.947Z","lastChangeDetectedAt":"2026-10-08T03:11:35.451Z","scannedHash":"2bc3e3c7a9e83293800774444430fe8ee0c9438a","latestUpstreamHash":"2bc3e3c7a9e83293800774444430fe8ee0c9438a","nextCheckDueAt":"2026-10-23T01:14:05.272Z"}},{"id":"cmv8o7srneddlad06a644ecby","slug":"general-video","publicId":"515d1fe4-60bc-46a4-9ced-8c5c146046ba","name":"general-video","description":">","author":"","version":"","license":"Apache-2.0","overallGrade":"A","badgeStatus":"vettd","publishedAt":"2026-08-05T22:05:13.442Z","sourceUrl":"https://github.com/heygen-com/hyperframes/tree/main/skills/general-video","findings":[{"id":"cmv8o7srneddmad06shnni471","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE"}],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":"A","criticalCount":0,"highCount":0},{"source":"cisco","status":"success","verdict":null,"grade":"A","criticalCount":0,"highCount":0}],"freshness":{"status":"unreachable","reason":"ref_not_found","retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-21T22:04:01.567Z","lastVerifiedAt":"2026-10-20T21:30:25.499Z","lastChangeDetectedAt":"2026-10-14T22:13:06.219Z","scannedHash":"ce11f731c639aab22d08c6f6d6c97499ddfb0b64","latestUpstreamHash":"ce11f731c639aab22d08c6f6d6c97499ddfb0b64","nextCheckDueAt":"2026-10-28T22:04:01.567Z"}},{"id":"cmuximosl0s5aad078545fzx0","slug":"figma","publicId":"fa959bdf-26cb-4780-b2ea-522774737211","name":"figma","description":"Import Figma content into a HyperFrames composition — rendered assets, brand tokens, components, storyboard sections → reconstructed motion (frames read as states, not slides) (REST/CLI), connector-assisted motion when available, and shaders from a connector or native export. Use when the user pastes a figma.com link or asks to bring a Figma design, frame, logo, brand, or animation into a video/composition.","author":"","version":"","license":"Apache-2.0","overallGrade":"F","badgeStatus":"flagged","publishedAt":"2026-08-05T22:05:12.730Z","sourceUrl":"https://github.com/heygen-com/hyperframes/tree/main/skills/figma","findings":[{"id":"cmuximosm0s5bad071s5f05wd","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/verify-motion.mjs:24 — `import { execFileSync, spawnSync } from \"node:child_process\";`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmuximosm0s5cad0711dducgg","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE"},{"id":"cmuximosm0s5dad07sl8zh8g9","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/verify-motion.mjs:24 — Pattern detected: from \"node:child_process\"","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmuximosm0s5ead07qdgdku3h","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"scripts/verify-motion.mjs:113 — Pattern detected: spawnSync(","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"}],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":"F","criticalCount":1,"highCount":1},{"source":"cisco","status":"success","verdict":null,"grade":"F","criticalCount":2,"highCount":2}],"freshness":{"status":"verified_unchanged","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-21T16:07:41.031Z","lastVerifiedAt":"2026-10-21T16:07:41.031Z","lastChangeDetectedAt":"2026-10-09T09:05:29.274Z","scannedHash":"00d8cd2eb6b34cd994bb391b556dda13b1b1e71c","latestUpstreamHash":"00d8cd2eb6b34cd994bb391b556dda13b1b1e71c","nextCheckDueAt":"2026-10-22T15:57:38.995Z"}},{"id":"cmuxk5fha1qxdad07dw6425fg","slug":"cut-the-curve","publicId":"6ca404af-8a22-4d11-8d9e-fae4a26c12eb","name":"cut-the-curve","description":"The technique catalog: five velocity-matched SEAMS (zoom-through, INVERSE zoom-through, cut-the-curve, waterfall cut, rack-focus blur-cut) plus the two in-scene techniques — waterfall ENTRY (staggered arrival cascades for title cards / segment openers) and the nudge curve (slow-fast-slow three-phase group slides). Covers partial-travel (~12% of frame) velocity matching via mirrored power4 eases, the Z scale-sign rule, size-scaled blur (10px text / 18-20px full-frame), word-by-word staggered cuts, cascade pacing by element weight, and the 10/65/25 slide ratio. Read before authoring any transition, text-beat handoff, kinetic text entry, or group reposition. [depth, zoom, inverse-zoom, scale-sign, mirrored-zoom, rack-focus, pacing, velocity, cut-the-curve, waterfall, stagger, cascade, kinetic-text, title-card, segment-opener, nudge, slide, easing, group-motion, z-depth, motion-graphics, cinematic, transition, blur, directional-continuity]","author":"","version":"","license":"Apache-2.0","overallGrade":"A","badgeStatus":"vettd","publishedAt":"2026-08-05T22:05:12.729Z","sourceUrl":"https://github.com/heygen-com/hyperframes/tree/main/.claude/skills/cut-the-curve","findings":[{"id":"cmuxk5fha1qxead07vk50m9ts","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE"}],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":"A","criticalCount":0,"highCount":0},{"source":"cisco","status":"success","verdict":null,"grade":"A","criticalCount":0,"highCount":0}],"freshness":{"status":"verified_unchanged","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-21T19:45:08.370Z","lastVerifiedAt":"2026-10-21T19:45:08.370Z","lastChangeDetectedAt":"2026-10-08T04:29:35.475Z","scannedHash":"2bc3e3c7a9e83293800774444430fe8ee0c9438a","latestUpstreamHash":"2bc3e3c7a9e83293800774444430fe8ee0c9438a","nextCheckDueAt":"2026-10-22T18:38:58.419Z"}}],"publisherSupplied":["skills[].name","skills[].description","skills[].author","skills[].version","skills[].license"]}