{"data":{"skill":{"slug":"heygen-com-media-use","name":"media-use","icon":"📦","repo":"https://github.com/heygen-com/hyperframes/tree/main/skills/media-use/","status":"approved","author":"heygen-com","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"5d7bb8a4-a6e9-4edf-b86a-bf7485e26a49","skill_id":"38876f0b-7849-49af-88b7-dbf817f58112","version":6,"content_hash":"v3:77d0e66fbadeb1f5d1e6a5aada7861240b8ed2d7:a66f5113dd5b2d53fc463b06c238a2bbd33ac8e6c1158f17ef849bb5117024ac:27757fb40489dd9c4d90ea01faec83c89cc2e9b798bd24e664382e0b921854c4:736b696c6c732f68657967656e2d636f6d2f6d656469612d757365:bec144fa706d478e383f29d3fae15ce2","risk_level":"critical","is_blocked":true,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"blocked","manual_install_policy":"allowed_with_warning","summary":"One critical finding is confirmed: the installation guidance pipes a remotely fetched script into bash without integrity verification. The remaining static matches are predominantly media-tool operations, documented configuration, relative links, or test fixtures; no prompt injection or credential-exfiltration intent was found. Static review was capped at 400/2029 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.","remediation":[{"issue":"Static review capped","severity":"medium","suggestion":"Manually review the omitted 1629 static analyzer matches or reduce bundled generated/vendor/reference content before enabling automatic publication."},{"issue":"Remote installer is executed directly through a shell pipeline.","severity":"critical","suggestion":"Provide a version-pinned release artifact with a published checksum or signature. Instruct users to download, inspect, verify, and then execute the installer."}],"risk_factor_evidence":[{"factor":"filesystem","evidence":[{"file":"audio/references/bgm.md","line_end":8,"line_start":8},{"file":"audio/references/bgm.md","line_end":5,"line_start":5},{"file":"audio/references/bgm.md","line_end":5,"line_start":5},{"file":"audio/references/captions/authoring.md","line_end":3,"line_start":3},{"file":"audio/references/captions/authoring.md","line_end":16,"line_start":16},{"file":"audio/references/captions/transcript-handling.md","line_end":3,"line_start":3},{"file":"audio/references/captions/transcript-handling.md","line_end":60,"line_start":60},{"file":"audio/references/captions/transcript-handling.md","line_end":96,"line_start":96},{"file":"audio/references/captions/transcript-handling.md","line_end":54,"line_start":54},{"file":"audio/references/requirements.md","line_end":9,"line_start":9},{"file":"audio/references/requirements.md","line_end":19,"line_start":19},{"file":"audio/references/requirements.md","line_end":21,"line_start":21},{"file":"audio/references/requirements.md","line_end":25,"line_start":25},{"file":"audio/references/requirements.md","line_end":9,"line_start":9},{"file":"audio/references/requirements.md","line_end":19,"line_start":19},{"file":"audio/references/requirements.md","line_end":21,"line_start":21},{"file":"audio/references/requirements.md","line_end":25,"line_start":25},{"file":"audio/references/tts.md","line_end":7,"line_start":7},{"file":"audio/references/tts.md","line_end":13,"line_start":13},{"file":"audio/references/tts.md","line_end":31,"line_start":31},{"file":"audio/references/tts.md","line_end":13,"line_start":13},{"file":"audio/references/tts.md","line_end":31,"line_start":31},{"file":"audio/scripts/audio.mjs","line_end":42,"line_start":42},{"file":"audio/scripts/audio.mjs","line_end":104,"line_start":104},{"file":"audio/scripts/audio.mjs","line_end":118,"line_start":118},{"file":"audio/scripts/audio.mjs","line_end":282,"line_start":282},{"file":"audio/scripts/audio.mjs","line_end":10,"line_start":10},{"file":"audio/scripts/audio.test.mjs","line_end":45,"line_start":45},{"file":"audio/scripts/audio.test.mjs","line_end":3,"line_start":3},{"file":"audio/scripts/audio.test.mjs","line_end":18,"line_start":18},{"file":"audio/scripts/audio.test.mjs","line_end":36,"line_start":36},{"file":"audio/scripts/heygen-tts.mjs","line_end":18,"line_start":18},{"file":"audio/scripts/heygen-tts.mjs","line_end":89,"line_start":89},{"file":"audio/scripts/heygen-tts.mjs","line_end":112,"line_start":112},{"file":"audio/scripts/heygen-tts.mjs","line_end":16,"line_start":16},{"file":"audio/scripts/heygen-tts.mjs","line_end":16,"line_start":16},{"file":"audio/scripts/lib/bgm.mjs","line_end":77,"line_start":77},{"file":"audio/scripts/lib/bgm.mjs","line_end":80,"line_start":80},{"file":"audio/scripts/lib/bgm.mjs","line_end":83,"line_start":83},{"file":"audio/scripts/lib/bgm.mjs","line_end":92,"line_start":92},{"file":"audio/scripts/lib/bgm.mjs","line_end":94,"line_start":94},{"file":"audio/scripts/lib/bgm.mjs","line_end":96,"line_start":96},{"file":"audio/scripts/lib/bgm.mjs","line_end":98,"line_start":98},{"file":"audio/scripts/lib/bgm.mjs","line_end":100,"line_start":100},{"file":"audio/scripts/lib/bgm.mjs","line_end":102,"line_start":102},{"file":"audio/scripts/lib/bgm.mjs","line_end":104,"line_start":104},{"file":"audio/scripts/lib/heygen.mjs","line_end":7,"line_start":7},{"file":"audio/scripts/lib/heygen.mjs","line_end":25,"line_start":25},{"file":"audio/scripts/lib/heygen.mjs","line_end":55,"line_start":55},{"file":"audio/scripts/lib/heygen.mjs","line_end":132,"line_start":132}]},{"factor":"env_access","evidence":[{"file":"audio/references/bgm.md","line_end":5,"line_start":5},{"file":"audio/references/bgm.md","line_end":40,"line_start":40},{"file":"audio/references/captions/transcript-handling.md","line_end":71,"line_start":71},{"file":"audio/references/captions/transcript-handling.md","line_end":84,"line_start":84},{"file":"audio/references/requirements.md","line_end":9,"line_start":9},{"file":"audio/references/requirements.md","line_end":10,"line_start":10},{"file":"audio/references/requirements.md","line_end":11,"line_start":11},{"file":"audio/references/requirements.md","line_end":21,"line_start":21},{"file":"audio/references/requirements.md","line_end":24,"line_start":24},{"file":"audio/references/tts.md","line_end":13,"line_start":13},{"file":"audio/references/tts.md","line_end":14,"line_start":14},{"file":"audio/references/tts.md","line_end":30,"line_start":30},{"file":"audio/references/tts.md","line_end":41,"line_start":41},{"file":"audio/scripts/audio.mjs","line_end":79,"line_start":79},{"file":"audio/scripts/audio.mjs","line_end":79,"line_start":79},{"file":"audio/scripts/heygen-tts.mjs","line_end":16,"line_start":16},{"file":"audio/scripts/lib/bgm.mjs","line_end":21,"line_start":21},{"file":"audio/scripts/lib/bgm.mjs","line_end":21,"line_start":21},{"file":"audio/scripts/lib/bgm.mjs","line_end":33,"line_start":33},{"file":"audio/scripts/lib/bgm.mjs","line_end":7,"line_start":7},{"file":"audio/scripts/lib/bgm.mjs","line_end":21,"line_start":21},{"file":"audio/scripts/lib/heygen.mjs","line_end":38,"line_start":38},{"file":"audio/scripts/lib/heygen.mjs","line_end":50,"line_start":50},{"file":"audio/scripts/lib/heygen.mjs","line_end":53,"line_start":53},{"file":"audio/scripts/lib/heygen.mjs","line_end":38,"line_start":38},{"file":"audio/scripts/lib/heygen.mjs","line_end":50,"line_start":50},{"file":"audio/scripts/lib/heygen.mjs","line_end":53,"line_start":53},{"file":"audio/scripts/lib/heygen.mjs","line_end":3,"line_start":3},{"file":"audio/scripts/lib/heygen.mjs","line_end":4,"line_start":4},{"file":"audio/scripts/lib/heygen.mjs","line_end":50,"line_start":50},{"file":"audio/scripts/lib/heygen.mjs","line_end":71,"line_start":71},{"file":"audio/scripts/lib/heygen.mjs","line_end":73,"line_start":73},{"file":"audio/scripts/lib/heygen.mjs","line_end":77,"line_start":77},{"file":"audio/scripts/lib/heygen.mjs","line_end":85,"line_start":85},{"file":"audio/scripts/lib/heygen.mjs","line_end":105,"line_start":105},{"file":"audio/scripts/lib/heygen.test.mjs","line_end":9,"line_start":9},{"file":"audio/scripts/lib/heygen.test.mjs","line_end":10,"line_start":10},{"file":"audio/scripts/lib/heygen.test.mjs","line_end":11,"line_start":11},{"file":"audio/scripts/lib/heygen.test.mjs","line_end":13,"line_start":13},{"file":"audio/scripts/lib/heygen.test.mjs","line_end":14,"line_start":14},{"file":"audio/scripts/lib/heygen.test.mjs","line_end":15,"line_start":15},{"file":"audio/scripts/lib/heygen.test.mjs","line_end":18,"line_start":18},{"file":"audio/scripts/lib/heygen.test.mjs","line_end":19,"line_start":19},{"file":"audio/scripts/lib/heygen.test.mjs","line_end":20,"line_start":20},{"file":"audio/scripts/lib/heygen.test.mjs","line_end":21,"line_start":21},{"file":"audio/scripts/lib/heygen.test.mjs","line_end":22,"line_start":22},{"file":"audio/scripts/lib/heygen.test.mjs","line_end":23,"line_start":23},{"file":"audio/scripts/lib/heygen.test.mjs","line_end":29,"line_start":29},{"file":"audio/scripts/lib/heygen.test.mjs","line_end":44,"line_start":44},{"file":"audio/scripts/lib/heygen.test.mjs","line_end":67,"line_start":67}]},{"factor":"external_commands","evidence":[{"file":"audio/references/captions/authoring.md","line_end":92,"line_start":92},{"file":"audio/references/tts.md","line_end":49,"line_start":40},{"file":"audio/scripts/audio.mjs","line_end":4,"line_start":4},{"file":"audio/scripts/audio.mjs","line_end":61,"line_start":61},{"file":"audio/scripts/audio.mjs","line_end":64,"line_start":64},{"file":"audio/scripts/audio.mjs","line_end":66,"line_start":66},{"file":"audio/scripts/audio.mjs","line_end":101,"line_start":101},{"file":"audio/scripts/audio.mjs","line_end":106,"line_start":106},{"file":"audio/scripts/audio.mjs","line_end":138,"line_start":138},{"file":"audio/scripts/audio.mjs","line_end":143,"line_start":143},{"file":"audio/scripts/audio.mjs","line_end":146,"line_start":146},{"file":"audio/scripts/audio.mjs","line_end":158,"line_start":158},{"file":"audio/scripts/audio.mjs","line_end":165,"line_start":165},{"file":"audio/scripts/audio.mjs","line_end":173,"line_start":173},{"file":"audio/scripts/audio.mjs","line_end":208,"line_start":208},{"file":"audio/scripts/audio.mjs","line_end":215,"line_start":215},{"file":"audio/scripts/audio.mjs","line_end":217,"line_start":217},{"file":"audio/scripts/audio.mjs","line_end":220,"line_start":220},{"file":"audio/scripts/audio.mjs","line_end":239,"line_start":239},{"file":"audio/scripts/audio.mjs","line_end":250,"line_start":250},{"file":"audio/scripts/audio.mjs","line_end":267,"line_start":267},{"file":"audio/scripts/audio.mjs","line_end":284,"line_start":284},{"file":"audio/scripts/audio.mjs","line_end":285,"line_start":285},{"file":"audio/scripts/audio.mjs","line_end":287,"line_start":287},{"file":"audio/scripts/audio.mjs","line_end":289,"line_start":289},{"file":"audio/scripts/audio.mjs","line_end":291,"line_start":291},{"file":"audio/scripts/audio.mjs","line_end":292,"line_start":292},{"file":"audio/scripts/audio.test.mjs","line_end":26,"line_start":26},{"file":"audio/scripts/heygen-tts.mjs","line_end":5,"line_start":5},{"file":"audio/scripts/heygen-tts.mjs","line_end":25,"line_start":25},{"file":"audio/scripts/heygen-tts.mjs","line_end":32,"line_start":32},{"file":"audio/scripts/heygen-tts.mjs","line_end":76,"line_start":76},{"file":"audio/scripts/heygen-tts.mjs","line_end":80,"line_start":80},{"file":"audio/scripts/heygen-tts.mjs","line_end":94,"line_start":94},{"file":"audio/scripts/heygen-tts.mjs","line_end":115,"line_start":115},{"file":"audio/scripts/heygen-tts.mjs","line_end":120,"line_start":120},{"file":"audio/scripts/heygen-tts.mjs","line_end":121,"line_start":121},{"file":"audio/scripts/lib/bgm.mjs","line_end":14,"line_start":14},{"file":"audio/scripts/lib/bgm.mjs","line_end":148,"line_start":148},{"file":"audio/scripts/lib/bgm.mjs","line_end":166,"line_start":166},{"file":"audio/scripts/lib/bgm.mjs","line_end":38,"line_start":38},{"file":"audio/scripts/lib/bgm.mjs","line_end":48,"line_start":48},{"file":"audio/scripts/lib/bgm.mjs","line_end":40,"line_start":40},{"file":"audio/scripts/lib/bgm.mjs","line_end":41,"line_start":41},{"file":"audio/scripts/lib/bgm.mjs","line_end":43,"line_start":43},{"file":"audio/scripts/lib/bgm.mjs","line_end":44,"line_start":44},{"file":"audio/scripts/lib/bgm.mjs","line_end":45,"line_start":45},{"file":"audio/scripts/lib/bgm.mjs","line_end":93,"line_start":93},{"file":"audio/scripts/lib/bgm.mjs","line_end":95,"line_start":95},{"file":"audio/scripts/lib/bgm.mjs","line_end":97,"line_start":97}]},{"factor":"network","evidence":[{"file":"audio/references/captions/transcript-handling.md","line_end":70,"line_start":70},{"file":"audio/references/captions/transcript-handling.md","line_end":83,"line_start":83},{"file":"audio/scripts/lib/heygen.mjs","line_end":116,"line_start":116},{"file":"audio/scripts/lib/heygen.mjs","line_end":128,"line_start":128},{"file":"audio/scripts/lib/heygen.mjs","line_end":11,"line_start":11},{"file":"audio/scripts/lib/tts.test.mjs","line_end":117,"line_start":117},{"file":"audio/scripts/lib/tts.test.mjs","line_end":141,"line_start":141},{"file":"luts/index.json","line_end":9,"line_start":9},{"file":"luts/index.json","line_end":27,"line_start":27},{"file":"luts/index.json","line_end":44,"line_start":44},{"file":"references/operations.md","line_end":266,"line_start":266},{"file":"scripts/lib/freeze.mjs","line_end":10,"line_start":10},{"file":"scripts/lib/freeze.test.mjs","line_end":34,"line_start":34},{"file":"scripts/lib/freeze.test.mjs","line_end":6,"line_start":6},{"file":"scripts/lib/freeze.test.mjs","line_end":7,"line_start":7},{"file":"scripts/lib/freeze.test.mjs","line_end":8,"line_start":8},{"file":"scripts/lib/freeze.test.mjs","line_end":12,"line_start":12},{"file":"scripts/lib/freeze.test.mjs","line_end":13,"line_start":13},{"file":"scripts/lib/freeze.test.mjs","line_end":14,"line_start":14},{"file":"scripts/lib/freeze.test.mjs","line_end":15,"line_start":15},{"file":"scripts/lib/freeze.test.mjs","line_end":19,"line_start":19},{"file":"scripts/lib/freeze.test.mjs","line_end":26,"line_start":26},{"file":"scripts/lib/freeze.test.mjs","line_end":27,"line_start":27},{"file":"scripts/lib/freeze.test.mjs","line_end":28,"line_start":28},{"file":"scripts/lib/freeze.test.mjs","line_end":29,"line_start":29},{"file":"scripts/lib/freeze.test.mjs","line_end":30,"line_start":30},{"file":"scripts/lib/freeze.test.mjs","line_end":31,"line_start":31},{"file":"scripts/lib/freeze.test.mjs","line_end":32,"line_start":32},{"file":"scripts/lib/freeze.test.mjs","line_end":33,"line_start":33},{"file":"scripts/lib/freeze.test.mjs","line_end":34,"line_start":34},{"file":"scripts/lib/freeze.test.mjs","line_end":35,"line_start":35},{"file":"scripts/lib/freeze.test.mjs","line_end":36,"line_start":36},{"file":"scripts/lib/freeze.test.mjs","line_end":37,"line_start":37},{"file":"scripts/lib/freeze.test.mjs","line_end":38,"line_start":38},{"file":"scripts/lib/freeze.test.mjs","line_end":39,"line_start":39},{"file":"scripts/lib/freeze.test.mjs","line_end":44,"line_start":44},{"file":"scripts/lib/freeze.test.mjs","line_end":45,"line_start":45},{"file":"scripts/lib/freeze.test.mjs","line_end":27,"line_start":27},{"file":"scripts/lib/freeze.test.mjs","line_end":28,"line_start":28},{"file":"scripts/lib/freeze.test.mjs","line_end":29,"line_start":29},{"file":"scripts/lib/freeze.test.mjs","line_end":30,"line_start":30},{"file":"scripts/lib/freeze.test.mjs","line_end":31,"line_start":31},{"file":"scripts/lib/freeze.test.mjs","line_end":32,"line_start":32},{"file":"scripts/lib/freeze.test.mjs","line_end":33,"line_start":33},{"file":"scripts/lib/freeze.test.mjs","line_end":34,"line_start":34},{"file":"scripts/lib/freeze.test.mjs","line_end":44,"line_start":44},{"file":"scripts/lib/freeze.test.mjs","line_end":20,"line_start":20},{"file":"scripts/lib/heygen-cli.mjs","line_end":13,"line_start":13},{"file":"scripts/lib/heygen-video-provider.test.mjs","line_end":36,"line_start":36},{"file":"scripts/lib/heygen-video-provider.test.mjs","line_end":49,"line_start":49}]},{"factor":"scripts","evidence":[{"file":"audio/scripts/lib/bgm.mjs","line_end":232,"line_start":232},{"file":"audio/scripts/lib/tts.mjs","line_end":93,"line_start":93},{"file":"scripts/lib/coverage.test.mjs","line_end":47,"line_start":47},{"file":"scripts/lib/coverage.test.mjs","line_end":53,"line_start":53},{"file":"scripts/lib/coverage.test.mjs","line_end":55,"line_start":55},{"file":"scripts/lib/coverage.test.mjs","line_end":65,"line_start":65},{"file":"scripts/lib/coverage.test.mjs","line_end":71,"line_start":71},{"file":"scripts/lib/coverage.test.mjs","line_end":75,"line_start":75},{"file":"scripts/lib/coverage.test.mjs","line_end":99,"line_start":99},{"file":"scripts/lib/coverage.test.mjs","line_end":106,"line_start":106},{"file":"scripts/lib/heygen-video-provider.test.mjs","line_end":15,"line_start":15},{"file":"scripts/lib/local-run.mjs","line_end":54,"line_start":54},{"file":"scripts/lib/manifest.mjs","line_end":124,"line_start":124},{"file":"scripts/lib/npx-sync.mjs","line_end":7,"line_start":7},{"file":"scripts/lib/specs.mjs","line_end":8,"line_start":8},{"file":"scripts/lib/specs.mjs","line_end":27,"line_start":27},{"file":"scripts/lib/specs.mjs","line_end":41,"line_start":41},{"file":"scripts/lib/specs.mjs","line_end":58,"line_start":58},{"file":"scripts/resolve.mjs","line_end":133,"line_start":133},{"file":"scripts/resolve.mjs","line_end":206,"line_start":206}]}],"critical_findings":[{"title":"Pipe to shell pattern","locations":[{"file":"SKILL.md","line_end":13,"line_start":13}],"confidence":0.99,"description":"curl -fsSL https://static.heygen.ai/cli/install.sh | bash","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The setup instructions pipe a remote installation script directly into bash without pinning or verification. A compromised or substituted endpoint would execute arbitrary code."}],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[{"title":"Pipe to shell pattern","locations":[{"file":"SKILL.md","line_end":13,"line_start":13}],"confidence":0.99,"description":"curl -fsSL https://static.heygen.ai/cli/install.sh | bash","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The setup instructions pipe a remote installation script directly into bash without pinning or verification. A compromised or substituted endpoint would execute arbitrary code."}],"files_scanned":120,"total_lines":17211,"audit_model":"claude","audited_at":"2026-07-19T11:03:07.091+00:00","created_at":"2026-07-19T15:35:39.934399+00:00","static_findings":[{"id":"blocker:audio/assets/sfx/manifest.json:50:keylogger-keywords","file":"audio/assets/sfx/manifest.json","pattern":"Keylogger keywords","snippet":"\"description\": \"Single key press — one keystroke / terminal-input beat. Short accent, sync to the ty","category":"blocker","line_end":50,"severity":"critical","line_start":50},{"id":"blocker:SKILL.md:13:pipe-to-shell-pattern","file":"SKILL.md","pattern":"Pipe to shell pattern","snippet":"curl -fsSL https://static.heygen.ai/cli/install.sh | bash","category":"blocker","line_end":13,"severity":"critical","line_start":13},{"id":"blocker:SKILL.md:415:pipe-to-shell-pattern","file":"SKILL.md","pattern":"Pipe to shell pattern","snippet":"| `heygen`           | catalog (bgm/sfx/image/icon) + TTS (voice) + avatar video — the free-usage pa","category":"blocker","line_end":415,"severity":"critical","line_start":415},{"id":"obfuscation:multiple:1:heuristic-dangerous-combination-code-execution-n","file":"multiple","pattern":"[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access","snippet":"This combination is common in credential stealers and RATs","category":"obfuscation","line_end":1,"severity":"critical","line_start":1},{"id":"obfuscation:multiple:1:heuristic-dangerous-combination-network-credenti","file":"multiple","pattern":"[HEURISTIC] DANGEROUS COMBINATION: Network + Credentials + Evasion techniques","snippet":"This combination suggests data exfiltration with anti-detection","category":"obfuscation","line_end":1,"severity":"critical","line_start":1},{"id":"network:scripts/lib/freeze.test.mjs:34:aws-azure-metadata-endpoint","file":"scripts/lib/freeze.test.mjs","pattern":"AWS/Azure metadata endpoint","snippet":"\"http://169.254.169.254/a.mp4\", // cloud metadata endpoint","category":"network","line_end":34,"severity":"critical","line_start":34},{"id":"sensitive:audio/scripts/audio.mjs:192:certificate-key-files","file":"audio/scripts/audio.mjs","pattern":"Certificate/key files","snippet":"Object.keys(bgmFields).forEach((k) => (bgmFields[k] = k === \"bgm_pending\" ? false : null));","category":"sensitive","line_end":192,"severity":"high","line_start":192},{"id":"sensitive:audio/scripts/lib/heygen.mjs:153:certificate-key-files","file":"audio/scripts/lib/heygen.mjs","pattern":"Certificate/key files","snippet":"`unexpected /audio/sounds shape — top keys: ${Object.keys(payload ?? {}).join(\", \")}`,","category":"sensitive","line_end":153,"severity":"high","line_start":153},{"id":"sensitive:audio/scripts/lib/sfx.mjs:107:certificate-key-files","file":"audio/scripts/lib/sfx.mjs","pattern":"Certificate/key files","snippet":"const known = [...new Set([...byKey.values()].map((v) => v.key))].slice(0, 8).join(\", \");","category":"sensitive","line_end":107,"severity":"high","line_start":107},{"id":"sensitive:scripts/lib/bundled-sfx-provider.mjs:91:certificate-key-files","file":"scripts/lib/bundled-sfx-provider.mjs","pattern":"Certificate/key files","snippet":".sort((a, b) => b.score - a.score || a.key.localeCompare(b.key));","category":"sensitive","line_end":91,"severity":"high","line_start":91},{"id":"sensitive:scripts/lib/bundled-sfx-provider.mjs:101:certificate-key-files","file":"scripts/lib/bundled-sfx-provider.mjs","pattern":"Certificate/key files","snippet":"description: best.entry.description || best.key,","category":"sensitive","line_end":101,"severity":"high","line_start":101},{"id":"sensitive:scripts/lib/bundled-sfx-provider.mjs:104:certificate-key-files","file":"scripts/lib/bundled-sfx-provider.mjs","pattern":"Certificate/key files","snippet":"provenance: { library_key: best.key },","category":"sensitive","line_end":104,"severity":"high","line_start":104},{"id":"sensitive:scripts/lib/misses.test.mjs:17:certificate-key-files","file":"scripts/lib/misses.test.mjs","pattern":"Certificate/key files","snippet":"for (const k of Object.keys(process.env)) if (!(k in saved)) delete process.env[k];","category":"sensitive","line_end":17,"severity":"high","line_start":17},{"id":"sensitive:scripts/lib/prefs-store.test.mjs:27:certificate-key-files","file":"scripts/lib/prefs-store.test.mjs","pattern":"Certificate/key files","snippet":"for (const k of Object.keys(process.env)) if (!(k in saved)) delete process.env[k];","category":"sensitive","line_end":27,"severity":"high","line_start":27},{"id":"sensitive:scripts/lib/probe.test.mjs:26:certificate-key-files","file":"scripts/lib/probe.test.mjs","pattern":"Certificate/key files","snippet":"assert.deepEqual(Object.keys(meta).sort(), [\"codec\", \"duration\", \"height\", \"width\"]);","category":"sensitive","line_end":26,"severity":"high","line_start":26},{"id":"sensitive:scripts/lib/recipe-store.test.mjs:91:certificate-key-files","file":"scripts/lib/recipe-store.test.mjs","pattern":"Certificate/key files","snippet":"for (const k of Object.keys(process.env)) if (!(k in saved)) delete process.env[k];","category":"sensitive","line_end":91,"severity":"high","line_start":91},{"id":"sensitive:scripts/lib/registry.mjs:122:certificate-key-files","file":"scripts/lib/registry.mjs","pattern":"Certificate/key files","snippet":"return Object.keys(REGISTRY);","category":"sensitive","line_end":122,"severity":"high","line_start":122},{"id":"sensitive:scripts/lib/stats.test.mjs:19:certificate-key-files","file":"scripts/lib/stats.test.mjs","pattern":"Certificate/key files","snippet":"for (const k of Object.keys(process.env)) if (!(k in saved)) delete process.env[k];","category":"sensitive","line_end":19,"severity":"high","line_start":19},{"id":"sensitive:audio/references/requirements.md:15:environment-file-access","file":"audio/references/requirements.md","pattern":"Environment file access","snippet":"`hyperframes auth login` (browser OAuth) is the recommended setup: one sign-in, every project, no pe","category":"sensitive","line_end":15,"severity":"high","line_start":15},{"id":"sensitive:audio/references/tts.md:30:environment-file-access","file":"audio/references/tts.md","pattern":"Environment file access","snippet":"wins: `$HEYGEN_API_KEY` → `$HYPERFRAMES_API_KEY` → a project `.env` (auto-loaded,","category":"sensitive","line_end":30,"severity":"high","line_start":30},{"id":"sensitive:audio/references/tts.md:41:environment-file-access","file":"audio/references/tts.md","pattern":"Environment file access","snippet":"export HEYGEN_API_KEY=...   # or put it in a project .env","category":"sensitive","line_end":41,"severity":"high","line_start":41},{"id":"sensitive:audio/scripts/audio.mjs:79:environment-file-access","file":"audio/scripts/audio.mjs","pattern":"Environment file access","snippet":"const ttsConcurrency = Math.max(1, Number(process.env.HYPERFRAMES_TTS_CONCURRENCY) || 4);","category":"sensitive","line_end":79,"severity":"high","line_start":79},{"id":"sensitive:audio/scripts/lib/bgm.mjs:21:environment-file-access","file":"audio/scripts/lib/bgm.mjs","pattern":"Environment file access","snippet":"const lyriaKey = () => process.env.GEMINI_API_KEY || process.env.GOOGLE_API_KEY || \"\";","category":"sensitive","line_end":21,"severity":"high","line_start":21},{"id":"sensitive:audio/scripts/lib/heygen.mjs:3:environment-file-access","file":"audio/scripts/lib/heygen.mjs","pattern":"Environment file access","snippet":"// usable source wins — $HEYGEN_API_KEY / $HYPERFRAMES_API_KEY → a nearby .env → ~/.heygen/","category":"sensitive","line_end":3,"severity":"high","line_start":3},{"id":"sensitive:audio/scripts/lib/heygen.mjs:19:environment-file-access","file":"audio/scripts/lib/heygen.mjs","pattern":"Environment file access","snippet":"// Walk up ≤5 dirs from startDir; load the first .env (shell env always wins).","category":"sensitive","line_end":19,"severity":"high","line_start":19},{"id":"sensitive:audio/scripts/lib/heygen.mjs:23:environment-file-access","file":"audio/scripts/lib/heygen.mjs","pattern":"Environment file access","snippet":"const envPath = join(dir, \".env\");","category":"sensitive","line_end":23,"severity":"high","line_start":23},{"id":"sensitive:audio/scripts/lib/heygen.mjs:38:environment-file-access","file":"audio/scripts/lib/heygen.mjs","pattern":"Environment file access","snippet":"if (!(key in process.env)) process.env[key] = val;","category":"sensitive","line_end":38,"severity":"high","line_start":38},{"id":"sensitive:scripts/lib/bundled-sfx-provider.mjs:5:environment-file-access","file":"scripts/lib/bundled-sfx-provider.mjs","pattern":"Environment file access","snippet":"process.env.HYPERFRAMES_MEDIA_USE_SFX_DIR ||","category":"sensitive","line_end":5,"severity":"high","line_start":5},{"id":"sensitive:scripts/lib/candidates.test.mjs:15:environment-file-access","file":"scripts/lib/candidates.test.mjs","pattern":"Environment file access","snippet":"process.env.HOME = home;","category":"sensitive","line_end":15,"severity":"high","line_start":15},{"id":"sensitive:scripts/lib/codex-provider.mjs:20:environment-file-access","file":"scripts/lib/codex-provider.mjs","pattern":"Environment file access","snippet":"return join(process.env.CODEX_HOME || join(homedir(), \".codex\"), \"generated_images\");","category":"sensitive","line_end":20,"severity":"high","line_start":20},{"id":"sensitive:scripts/lib/codex-provider.mjs:77:environment-file-access","file":"scripts/lib/codex-provider.mjs","pattern":"Environment file access","snippet":"const authPath = join(process.env.CODEX_HOME || join(homedir(), \".codex\"), \"auth.json\");","category":"sensitive","line_end":77,"severity":"high","line_start":77},{"id":"sensitive:scripts/lib/grade-analyzer.mjs:8:environment-file-access","file":"scripts/lib/grade-analyzer.mjs","pattern":"Environment file access","snippet":"const SIGNALSTATS_TIMEOUT_MS = Number(process.env.HYPERFRAMES_ANALYZE_TIMEOUT_MS) || 15000;","category":"sensitive","line_end":8,"severity":"high","line_start":8},{"id":"sensitive:scripts/lib/heygen-cli.test.mjs:203:environment-file-access","file":"scripts/lib/heygen-cli.test.mjs","pattern":"Environment file access","snippet":"const previousOptOut = process.env.HYPERFRAMES_NO_TELEMETRY;","category":"sensitive","line_end":203,"severity":"high","line_start":203},{"id":"sensitive:scripts/lib/heygen-cli.test.mjs:204:environment-file-access","file":"scripts/lib/heygen-cli.test.mjs","pattern":"Environment file access","snippet":"process.env.HYPERFRAMES_NO_TELEMETRY = \"1\";","category":"sensitive","line_end":204,"severity":"high","line_start":204},{"id":"sensitive:scripts/lib/heygen-cli.test.mjs:211:environment-file-access","file":"scripts/lib/heygen-cli.test.mjs","pattern":"Environment file access","snippet":"delete process.env.HYPERFRAMES_NO_TELEMETRY;","category":"sensitive","line_end":211,"severity":"high","line_start":211},{"id":"sensitive:scripts/lib/heygen-cli.test.mjs:213:environment-file-access","file":"scripts/lib/heygen-cli.test.mjs","pattern":"Environment file access","snippet":"process.env.HYPERFRAMES_NO_TELEMETRY = previousOptOut;","category":"sensitive","line_end":213,"severity":"high","line_start":213},{"id":"obfuscation:multiple:1:heuristic-suspicious-combination-filesystem-cred","file":"multiple","pattern":"[HEURISTIC] SUSPICIOUS COMBINATION: Filesystem + Credentials + Network","snippet":"This combination could indicate credential harvesting and exfiltration","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/lib/adopt.test.mjs:83:hex-encoded-characters","file":"scripts/lib/adopt.test.mjs","pattern":"Hex-encoded characters","snippet":"console.log(`  \\x1b[32m✓\\x1b[0m ${name}`);","category":"obfuscation","line_end":83,"severity":"high","line_start":83},{"id":"obfuscation:scripts/lib/adopt.test.mjs:86:hex-encoded-characters","file":"scripts/lib/adopt.test.mjs","pattern":"Hex-encoded characters","snippet":"console.log(`  \\x1b[31m✗\\x1b[0m ${name}`);","category":"obfuscation","line_end":86,"severity":"high","line_start":86},{"id":"obfuscation:scripts/lib/manifest.test.mjs:376:hex-encoded-characters","file":"scripts/lib/manifest.test.mjs","pattern":"Hex-encoded characters","snippet":"console.log(`  \\x1b[32m✓\\x1b[0m ${name}`);","category":"obfuscation","line_end":376,"severity":"high","line_start":376},{"id":"obfuscation:scripts/lib/manifest.test.mjs:379:hex-encoded-characters","file":"scripts/lib/manifest.test.mjs","pattern":"Hex-encoded characters","snippet":"console.log(`  \\x1b[31m✗\\x1b[0m ${name}`);","category":"obfuscation","line_end":379,"severity":"high","line_start":379},{"id":"obfuscation:scripts/resolve.test.mjs:1018:hex-encoded-characters","file":"scripts/resolve.test.mjs","pattern":"Hex-encoded characters","snippet":"console.log(`  \\x1b[32m✓\\x1b[0m ${name}`);","category":"obfuscation","line_end":1018,"severity":"high","line_start":1018},{"id":"obfuscation:scripts/resolve.test.mjs:1021:hex-encoded-characters","file":"scripts/resolve.test.mjs","pattern":"Hex-encoded characters","snippet":"console.log(`  \\x1b[31m✗\\x1b[0m ${name}`);","category":"obfuscation","line_end":1021,"severity":"high","line_start":1021},{"id":"scripts:audio/scripts/lib/bgm.mjs:232:dynamic-code-evaluation-with-eval","file":"audio/scripts/lib/bgm.mjs","pattern":"Dynamic code evaluation with eval()","snippet":"model.eval()","category":"scripts","line_end":232,"severity":"high","line_start":232},{"id":"env_access:audio/references/bgm.md:5:generic-api-secret-keys","file":"audio/references/bgm.md","pattern":"Generic API/secret keys","snippet":"- **HeyGen retrieval — the default when credentialed.** Search HeyGen's music catalog by mood, downl","category":"env_access","line_end":5,"severity":"high","line_start":5},{"id":"env_access:audio/references/bgm.md:40:generic-api-secret-keys","file":"audio/references/bgm.md","pattern":"Generic API/secret keys","snippet":"| 1     | Google Lyria RealTime                | `$GEMINI_API_KEY` or `$GOOGLE_API_KEY` + `google-ge","category":"env_access","line_end":40,"severity":"high","line_start":40},{"id":"env_access:audio/references/captions/transcript-handling.md:71:generic-api-secret-keys","file":"audio/references/captions/transcript-handling.md","pattern":"Generic API/secret keys","snippet":"-H \"Authorization: Bearer $OPENAI_API_KEY\" \\","category":"env_access","line_end":71,"severity":"high","line_start":71},{"id":"env_access:audio/references/captions/transcript-handling.md:84:generic-api-secret-keys","file":"audio/references/captions/transcript-handling.md","pattern":"Generic API/secret keys","snippet":"-H \"Authorization: Bearer $GROQ_API_KEY\" \\","category":"env_access","line_end":84,"severity":"high","line_start":84},{"id":"env_access:audio/references/requirements.md:9:generic-api-secret-keys","file":"audio/references/requirements.md","pattern":"Generic API/secret keys","snippet":"| **HeyGen** (TTS + BGM/SFX retrieval) | `$HEYGEN_API_KEY` → `$HYPERFRAMES_API_KEY` → `~/.heygen/cre","category":"env_access","line_end":9,"severity":"high","line_start":9},{"id":"env_access:audio/references/requirements.md:10:generic-api-secret-keys","file":"audio/references/requirements.md","pattern":"Generic API/secret keys","snippet":"| **ElevenLabs** (TTS fallback)        | `$ELEVENLABS_API_KEY`                                      ","category":"env_access","line_end":10,"severity":"high","line_start":10},{"id":"env_access:audio/references/requirements.md:11:generic-api-secret-keys","file":"audio/references/requirements.md","pattern":"Generic API/secret keys","snippet":"| **Lyria** (BGM fallback)             | `$GEMINI_API_KEY` → `$GOOGLE_API_KEY`                      ","category":"env_access","line_end":11,"severity":"high","line_start":11},{"id":"env_access:audio/references/requirements.md:21:generic-api-secret-keys","file":"audio/references/requirements.md","pattern":"Generic API/secret keys","snippet":"- **TTS (HeyGen)** — no local deps; needs a HeyGen credential + `ffmpeg` on PATH (to transcode the m","category":"env_access","line_end":21,"severity":"high","line_start":21},{"id":"env_access:audio/references/requirements.md:24:generic-api-secret-keys","file":"audio/references/requirements.md","pattern":"Generic API/secret keys","snippet":"- **BGM (Lyria)** — needs `$GEMINI_API_KEY` or `$GOOGLE_API_KEY` + `pip install google-genai`. No lo","category":"env_access","line_end":24,"severity":"high","line_start":24},{"id":"env_access:scripts/lib/telemetry.mjs:19:generic-api-secret-keys","file":"scripts/lib/telemetry.mjs","pattern":"Generic API/secret keys","snippet":"const POSTHOG_API_KEY = \"phc_zjjbX0PnWxERXrMHhkEJWj9A9BhGVLRReICgsfTMmpx\";","category":"env_access","line_end":19,"severity":"high","line_start":19},{"id":"env_access:scripts/lib/telemetry.mjs:175:generic-api-secret-keys","file":"scripts/lib/telemetry.mjs","pattern":"Generic API/secret keys","snippet":"body: JSON.stringify({ api_key: POSTHOG_API_KEY, batch }),","category":"env_access","line_end":175,"severity":"high","line_start":175},{"id":"env_access:scripts/resolve.test.mjs:337:generic-api-secret-keys","file":"scripts/resolve.test.mjs","pattern":"Generic API/secret keys","snippet":"test(\"manifest hit for an API-key-credentialed heygen resolve surfaces authMethod: api_key\", () => {","category":"env_access","line_end":337,"severity":"high","line_start":337},{"id":"env_access:scripts/resolve.test.mjs:343:generic-api-secret-keys","file":"scripts/resolve.test.mjs","pattern":"Generic API/secret keys","snippet":"provenance: { provider: \"heygen.tts\", authMethod: \"api_key\", prompt: \"api key voice\" },","category":"env_access","line_end":343,"severity":"high","line_start":343},{"id":"env_access:scripts/resolve.test.mjs:361:generic-api-secret-keys","file":"scripts/resolve.test.mjs","pattern":"Generic API/secret keys","snippet":"assert.equal(parsed.provenance.authMethod, \"api_key\");","category":"env_access","line_end":361,"severity":"high","line_start":361},{"id":"filesystem:audio/references/bgm.md:5:hidden-file-in-home-directory","file":"audio/references/bgm.md","pattern":"Hidden file in home directory","snippet":"- **HeyGen retrieval — the default when credentialed.** Search HeyGen's music catalog by mood, downl","category":"filesystem","line_end":5,"severity":"high","line_start":5},{"id":"filesystem:audio/references/requirements.md:9:hidden-file-in-home-directory","file":"audio/references/requirements.md","pattern":"Hidden file in home directory","snippet":"| **HeyGen** (TTS + BGM/SFX retrieval) | `$HEYGEN_API_KEY` → `$HYPERFRAMES_API_KEY` → `~/.heygen/cre","category":"filesystem","line_end":9,"severity":"high","line_start":9},{"id":"filesystem:audio/references/requirements.md:19:hidden-file-in-home-directory","file":"audio/references/requirements.md","pattern":"Hidden file in home directory","snippet":"Each command downloads its own model on first run and caches it under `~/.cache/hyperframes/`:","category":"filesystem","line_end":19,"severity":"high","line_start":19},{"id":"filesystem:audio/references/requirements.md:21:hidden-file-in-home-directory","file":"audio/references/requirements.md","pattern":"Hidden file in home directory","snippet":"- **TTS (HeyGen)** — no local deps; needs a HeyGen credential + `ffmpeg` on PATH (to transcode the m","category":"filesystem","line_end":21,"severity":"high","line_start":21},{"id":"filesystem:audio/references/requirements.md:25:hidden-file-in-home-directory","file":"audio/references/requirements.md","pattern":"Hidden file in home directory","snippet":"- **BGM (MusicGen)** — `pip install transformers torch soundfile`. `facebook/musicgen-small` (~300 M","category":"filesystem","line_end":25,"severity":"high","line_start":25},{"id":"filesystem:audio/references/tts.md:13:hidden-file-in-home-directory","file":"audio/references/tts.md","pattern":"Hidden file in home directory","snippet":"| 1     | HeyGen (Starfish) | `$HEYGEN_API_KEY` / `~/.heygen/credentials` | UUIDs from `GET /v3/voic","category":"filesystem","line_end":13,"severity":"high","line_start":13},{"id":"filesystem:audio/references/tts.md:31:hidden-file-in-home-directory","file":"audio/references/tts.md","pattern":"Hidden file in home directory","snippet":"walks up ≤5 dirs) → `~/.heygen/credentials` (shared with heygen-cli;","category":"filesystem","line_end":31,"severity":"high","line_start":31},{"id":"filesystem:audio/scripts/heygen-tts.mjs:16:hidden-file-in-home-directory","file":"audio/scripts/heygen-tts.mjs","pattern":"Hidden file in home directory","snippet":"// Requires: $HEYGEN_API_KEY / OAuth ~/.heygen credentials and ffmpeg for .wav output.","category":"filesystem","line_end":16,"severity":"high","line_start":16},{"id":"filesystem:audio/scripts/lib/heygen.mjs:3:hidden-file-in-home-directory","file":"audio/scripts/lib/heygen.mjs","pattern":"Hidden file in home directory","snippet":"// usable source wins — $HEYGEN_API_KEY / $HYPERFRAMES_API_KEY → a nearby .env → ~/.heygen/","category":"filesystem","line_end":3,"severity":"high","line_start":3},{"id":"filesystem:references/operations.md:78:hidden-file-in-home-directory","file":"references/operations.md","pattern":"Hidden file in home directory","snippet":"# install once: uv venv ~/.venvs/parakeet && VIRTUAL_ENV=~/.venvs/parakeet uv pip install parakeet-m","category":"filesystem","line_end":78,"severity":"high","line_start":78},{"id":"filesystem:references/telemetry-dashboard.md:8:hidden-file-in-home-directory","file":"references/telemetry-dashboard.md","pattern":"Hidden file in home directory","snippet":"`.media/` + `~/.media`, no PostHog access needed).","category":"filesystem","line_end":8,"severity":"high","line_start":8},{"id":"filesystem:references/telemetry-dashboard.md:13:hidden-file-in-home-directory","file":"references/telemetry-dashboard.md","pattern":"Hidden file in home directory","snippet":"— the shared install id in `~/.hyperframes/config.json` (`anonymousId`), stitched","category":"filesystem","line_end":13,"severity":"high","line_start":13},{"id":"filesystem:scripts/lib/cache.mjs:34:hidden-file-in-home-directory","file":"scripts/lib/cache.mjs","pattern":"Hidden file in home directory","snippet":"// the latter nested it at ~/.media/.media/manifest.jsonl, invisible to the","category":"filesystem","line_end":34,"severity":"high","line_start":34},{"id":"filesystem:scripts/lib/candidates.mjs:2:hidden-file-in-home-directory","file":"scripts/lib/candidates.mjs","pattern":"Hidden file in home directory","snippet":"// project (its own manifest) and across every project (the global ~/.media","category":"filesystem","line_end":2,"severity":"high","line_start":2},{"id":"filesystem:scripts/lib/candidates.test.mjs:10:hidden-file-in-home-directory","file":"scripts/lib/candidates.test.mjs","pattern":"Hidden file in home directory","snippet":"// to a temp dir and seed a fake global ~/.media manifest deterministically.","category":"filesystem","line_end":10,"severity":"high","line_start":10},{"id":"filesystem:scripts/lib/codex-provider.mjs:68:hidden-file-in-home-directory","file":"scripts/lib/codex-provider.mjs","pattern":"Hidden file in home directory","snippet":"return 'codex CLI not reachable on PATH (a shell alias won\\'t work — spawned processes can\\'t see al","category":"filesystem","line_end":68,"severity":"high","line_start":68},{"id":"filesystem:scripts/lib/local-models.mjs:63:hidden-file-in-home-directory","file":"scripts/lib/local-models.mjs","pattern":"Hidden file in home directory","snippet":"\"uv venv ~/.venvs/parakeet && VIRTUAL_ENV=~/.venvs/parakeet uv pip install parakeet-mlx\",","category":"filesystem","line_end":63,"severity":"high","line_start":63},{"id":"filesystem:scripts/lib/local-models.mjs:162:hidden-file-in-home-directory","file":"scripts/lib/local-models.mjs","pattern":"Hidden file in home directory","snippet":"install: \"uv venv ~/.venvs/mflux && VIRTUAL_ENV=~/.venvs/mflux uv pip install mflux==0.9.6\",","category":"filesystem","line_end":162,"severity":"high","line_start":162},{"id":"filesystem:scripts/lib/local-models.mjs:175:hidden-file-in-home-directory","file":"scripts/lib/local-models.mjs","pattern":"Hidden file in home directory","snippet":"install: \"uv venv ~/.venvs/mflux && VIRTUAL_ENV=~/.venvs/mflux uv pip install mflux\",","category":"filesystem","line_end":175,"severity":"high","line_start":175},{"id":"filesystem:scripts/lib/local-models.mjs:188:hidden-file-in-home-directory","file":"scripts/lib/local-models.mjs","pattern":"Hidden file in home directory","snippet":"install: \"uv venv ~/.venvs/mflux && VIRTUAL_ENV=~/.venvs/mflux uv pip install mflux\",","category":"filesystem","line_end":188,"severity":"high","line_start":188},{"id":"filesystem:scripts/lib/prefs-store.mjs:11:hidden-file-in-home-directory","file":"scripts/lib/prefs-store.mjs","pattern":"Hidden file in home directory","snippet":"* - user `~/.media/preferences.json` — personal, cross-repo. A key is promoted","category":"filesystem","line_end":11,"severity":"high","line_start":11},{"id":"filesystem:SKILL.md:37:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"| No cross-project memory                    | global content-addressed cache + auto-promote (`~/.me","category":"filesystem","line_end":37,"severity":"high","line_start":37},{"id":"filesystem:SKILL.md:138:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"| `--stats`       | Print local usage stats from `.media/` and `~/.media`; no manifest changes      ","category":"filesystem","line_end":138,"severity":"high","line_start":138},{"id":"filesystem:SKILL.md:283:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"3. Check global cache `~/.media/` for a reusable asset matched on the same normalized prompt — auto-","category":"filesystem","line_end":283,"severity":"high","line_start":283},{"id":"filesystem:SKILL.md:285:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"5. Freeze file to `.media/<type>/`, register in manifest, regenerate `index.md`, auto-promote to `~/","category":"filesystem","line_end":285,"severity":"high","line_start":285},{"id":"filesystem:SKILL.md:318:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"Assets are cached automatically on resolve. Every resolved/ingested asset is auto-promoted to the gl","category":"filesystem","line_end":318,"severity":"high","line_start":318},{"id":"filesystem:SKILL.md:324:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"The lightweight tier of user memory: confirmed brief answers (destination, aspect, language, flow, s","category":"filesystem","line_end":324,"severity":"high","line_start":324},{"id":"filesystem:SKILL.md:336:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"The heavyweight tier of user memory: one approved run frozen as a named, versioned bundle — `frame.m","category":"filesystem","line_end":336,"severity":"high","line_start":336},{"id":"filesystem:SKILL.md:348:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"Use `resolve --stats` for a local, shareable report over the current project's `.media/` manifest, t","category":"filesystem","line_end":348,"severity":"high","line_start":348},{"id":"filesystem:SKILL.md:363:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"- `~/.media/`: global cross-project reuse cache (content-addressed, SHA-256)","category":"filesystem","line_end":363,"severity":"high","line_start":363},{"id":"filesystem:scripts/lib/specs.mjs:22:linux-proc-filesystem-access","file":"scripts/lib/specs.mjs","pattern":"Linux /proc filesystem access","snippet":"// reclaimable). Linux: /proc/meminfo MemAvailable. Fallback: total (optimistic","category":"filesystem","line_end":22,"severity":"high","line_start":22},{"id":"filesystem:scripts/lib/specs.mjs:41:linux-proc-filesystem-access","file":"scripts/lib/specs.mjs","pattern":"Linux /proc filesystem access","snippet":"const out = String(exec(\"cat /proc/meminfo\"));","category":"filesystem","line_end":41,"severity":"high","line_start":41},{"id":"filesystem:scripts/lib/specs.test.mjs:23:linux-proc-filesystem-access","file":"scripts/lib/specs.test.mjs","pattern":"Linux /proc filesystem access","snippet":"test(\"availableRamMB is read from /proc/meminfo on Linux\", () => {","category":"filesystem","line_end":23,"severity":"high","line_start":23},{"id":"external_commands:audio/scripts/lib/bgm.mjs:14:node-js-child-process-module","file":"audio/scripts/lib/bgm.mjs","pattern":"Node.js child_process module","snippet":"import { spawn, spawnSync } from \"node:child_process\";","category":"external_commands","line_end":14,"severity":"high","line_start":14},{"id":"external_commands:audio/scripts/lib/python.mjs:15:node-js-child-process-module","file":"audio/scripts/lib/python.mjs","pattern":"Node.js child_process module","snippet":"import { spawnSync } from \"node:child_process\";","category":"external_commands","line_end":15,"severity":"high","line_start":15},{"id":"external_commands:audio/scripts/lib/tts.mjs:16:node-js-child-process-module","file":"audio/scripts/lib/tts.mjs","pattern":"Node.js child_process module","snippet":"import { spawn, spawnSync } from \"node:child_process\";","category":"external_commands","line_end":16,"severity":"high","line_start":16},{"id":"external_commands:audio/scripts/lib/tts.mjs:168:node-js-child-process-module","file":"audio/scripts/lib/tts.mjs","pattern":"Node.js child_process module","snippet":"// exist so tests can exercise the win32 branch without mocking node:child_process","category":"external_commands","line_end":168,"severity":"high","line_start":168},{"id":"external_commands:audio/scripts/lib/tts.spawn.test.mjs:15:node-js-child-process-module","file":"audio/scripts/lib/tts.spawn.test.mjs","pattern":"Node.js child_process module","snippet":"// need to touch the real process.platform or mock node:child_process (whose","category":"external_commands","line_end":15,"severity":"high","line_start":15},{"id":"external_commands:scripts/eval.mjs:18:node-js-child-process-module","file":"scripts/eval.mjs","pattern":"Node.js child_process module","snippet":"import { execFileSync } from \"node:child_process\";","category":"external_commands","line_end":18,"severity":"high","line_start":18},{"id":"external_commands:scripts/lib/codex-provider.mjs:1:node-js-child-process-module","file":"scripts/lib/codex-provider.mjs","pattern":"Node.js child_process module","snippet":"import { execFileSync } from \"node:child_process\";","category":"external_commands","line_end":1,"severity":"high","line_start":1},{"id":"external_commands:scripts/lib/cube-validate.test.mjs:3:node-js-child-process-module","file":"scripts/lib/cube-validate.test.mjs","pattern":"Node.js child_process module","snippet":"import { execFileSync } from \"node:child_process\";","category":"external_commands","line_end":3,"severity":"high","line_start":3},{"id":"external_commands:scripts/lib/cutlist.test.mjs:2:node-js-child-process-module","file":"scripts/lib/cutlist.test.mjs","pattern":"Node.js child_process module","snippet":"import { execFileSync } from \"node:child_process\";","category":"external_commands","line_end":2,"severity":"high","line_start":2},{"id":"external_commands:scripts/lib/duck.test.mjs:2:node-js-child-process-module","file":"scripts/lib/duck.test.mjs","pattern":"Node.js child_process module","snippet":"import { execFileSync } from \"node:child_process\";","category":"external_commands","line_end":2,"severity":"high","line_start":2},{"id":"external_commands:scripts/lib/grade-analyzer.mjs:1:node-js-child-process-module","file":"scripts/lib/grade-analyzer.mjs","pattern":"Node.js child_process module","snippet":"import { execFileSync } from \"node:child_process\";","category":"external_commands","line_end":1,"severity":"high","line_start":1},{"id":"external_commands:scripts/lib/grade-analyzer.test.mjs:2:node-js-child-process-module","file":"scripts/lib/grade-analyzer.test.mjs","pattern":"Node.js child_process module","snippet":"import { execFileSync, spawnSync } from \"node:child_process\";","category":"external_commands","line_end":2,"severity":"high","line_start":2},{"id":"external_commands:scripts/lib/heygen-cli.mjs:1:node-js-child-process-module","file":"scripts/lib/heygen-cli.mjs","pattern":"Node.js child_process module","snippet":"import { execFileSync } from \"node:child_process\";","category":"external_commands","line_end":1,"severity":"high","line_start":1},{"id":"external_commands:scripts/lib/heygen-cli.test.mjs:2:node-js-child-process-module","file":"scripts/lib/heygen-cli.test.mjs","pattern":"Node.js child_process module","snippet":"import { spawnSync } from \"node:child_process\";","category":"external_commands","line_end":2,"severity":"high","line_start":2},{"id":"filesystem:audio/references/bgm.md:8:path-traversal-sequence","file":"audio/references/bgm.md","pattern":"Path traversal sequence","snippet":"> **Run the Preflight first — no credential is not a green light to silently generate locally.** Bef","category":"filesystem","line_end":8,"severity":"high","line_start":8},{"id":"filesystem:audio/references/captions/authoring.md:3:path-traversal-sequence","file":"audio/references/captions/authoring.md","pattern":"Path traversal sequence","snippet":"Before authoring: confirm the transcript came from the right Whisper model. CLI default `small.en` s","category":"filesystem","line_end":3,"severity":"high","line_start":3},{"id":"filesystem:audio/references/captions/authoring.md:16:path-traversal-sequence","file":"audio/references/captions/authoring.md","pattern":"Path traversal sequence","snippet":"`id` (`w0`, `w1`, ...) is the stable reference for per-word overrides and is added by `hyperframes t","category":"filesystem","line_end":16,"severity":"high","line_start":16},{"id":"filesystem:audio/references/captions/transcript-handling.md:3:path-traversal-sequence","file":"audio/references/captions/transcript-handling.md","pattern":"Path traversal sequence","snippet":"For the `transcribe` CLI invocation, the `.en`-translates-non-English rule, and whisper model select","category":"filesystem","line_end":3,"severity":"high","line_start":3},{"id":"filesystem:audio/references/captions/transcript-handling.md:60:path-traversal-sequence","file":"audio/references/captions/transcript-handling.md","pattern":"Path traversal sequence","snippet":"For model-selection guidance by content type, see [`../transcribe.md`](../transcribe.md) → \"Picking ","category":"filesystem","line_end":60,"severity":"high","line_start":60},{"id":"filesystem:audio/references/captions/transcript-handling.md:96:path-traversal-sequence","file":"audio/references/captions/transcript-handling.md","pattern":"Path traversal sequence","snippet":"2. If none found, run [`../transcribe.md`](../transcribe.md) — pick the starting model from \"Picking","category":"filesystem","line_end":96,"severity":"high","line_start":96},{"id":"filesystem:audio/references/tts.md:7:path-traversal-sequence","file":"audio/references/tts.md","pattern":"Path traversal sequence","snippet":"> **Run the Preflight first — no credential is not a green light to silently use the local voice.** ","category":"filesystem","line_end":7,"severity":"high","line_start":7},{"id":"filesystem:audio/scripts/audio.mjs:10:path-traversal-sequence","file":"audio/scripts/audio.mjs","pattern":"Path traversal sequence","snippet":"// (credential present, NOT the CLI). This mirrors the table in ../SKILL.md:","category":"filesystem","line_end":10,"severity":"high","line_start":10},{"id":"filesystem:audio/scripts/lib/tts.mjs:2:path-traversal-sequence","file":"audio/scripts/lib/tts.mjs","pattern":"Path traversal sequence","snippet":"// auto-detected from env, is the one documented in ../SKILL.md:","category":"filesystem","line_end":2,"severity":"high","line_start":2},{"id":"filesystem:scripts/eval.mjs:344:path-traversal-sequence","file":"scripts/eval.mjs","pattern":"Path traversal sequence","snippet":"console.log(\"media-use eval · running against registry blocks...\\n\");","category":"filesystem","line_end":344,"severity":"high","line_start":344},{"id":"filesystem:scripts/lib/heygen-search.test.mjs:6:path-traversal-sequence","file":"scripts/lib/heygen-search.test.mjs","pattern":"Path traversal sequence","snippet":"import { HEYGEN_CLIENT_SOURCE_HEADERS } from \"../../audio/scripts/lib/heygen.mjs\";","category":"filesystem","line_end":6,"severity":"high","line_start":6},{"id":"filesystem:scripts/lib/npx-sync.mjs:2:path-traversal-sequence","file":"scripts/lib/npx-sync.mjs","pattern":"Path traversal sequence","snippet":"import { resolveSpawnCommand } from \"../../audio/scripts/lib/tts.mjs\";","category":"filesystem","line_end":2,"severity":"high","line_start":2},{"id":"filesystem:scripts/lib/tts-local-provider.mjs:5:path-traversal-sequence","file":"scripts/lib/tts-local-provider.mjs","pattern":"Path traversal sequence","snippet":"import { resolveSpawnCommand } from \"../../audio/scripts/lib/tts.mjs\";","category":"filesystem","line_end":5,"severity":"high","line_start":5},{"id":"filesystem:scripts/lib/tts-local-provider.mjs:33:path-traversal-sequence","file":"scripts/lib/tts-local-provider.mjs","pattern":"Path traversal sequence","snippet":"// spawnP in ../../audio/scripts/lib/tts.mjs.","category":"filesystem","line_end":33,"severity":"high","line_start":33},{"id":"filesystem:scripts/lib/tts-local-provider.test.mjs:9:path-traversal-sequence","file":"scripts/lib/tts-local-provider.test.mjs","pattern":"Path traversal sequence","snippet":"// TTS spawns (see ../../audio/scripts/lib/tts.spawn.test.mjs).","category":"filesystem","line_end":9,"severity":"high","line_start":9},{"id":"filesystem:scripts/resolve.mjs:26:path-traversal-sequence","file":"scripts/resolve.mjs","pattern":"Path traversal sequence","snippet":"import { heygenAuthMethod } from \"../audio/scripts/lib/heygen.mjs\";","category":"filesystem","line_end":26,"severity":"high","line_start":26},{"id":"external_commands:audio/scripts/lib/tts.mjs:93:process-exec","file":"audio/scripts/lib/tts.mjs","pattern":"Process exec","snippet":"const match = /Duration:\\s*(\\d+):(\\d+):(\\d+(?:\\.\\d+)?)/.exec(stderrText ?? \"\");","category":"external_commands","line_end":93,"severity":"high","line_start":93},{"id":"external_commands:scripts/lib/local-run.mjs:54:process-exec","file":"scripts/lib/local-run.mjs","pattern":"Process exec","snippet":"exec(fill(model.invoke, vars));","category":"external_commands","line_end":54,"severity":"high","line_start":54},{"id":"external_commands:scripts/lib/npx-sync.mjs:7:process-exec","file":"scripts/lib/npx-sync.mjs","pattern":"Process exec","snippet":"// execFileSync/spawnSync cannot exec (spawnSync npx ENOENT) —","category":"external_commands","line_end":7,"severity":"high","line_start":7},{"id":"external_commands:scripts/lib/specs.mjs:8:process-exec","file":"scripts/lib/specs.mjs","pattern":"Process exec","snippet":"// `osMod` and `exec` are injectable for tests. `exec(cmd)` returns the command's","category":"external_commands","line_end":8,"severity":"high","line_start":8},{"id":"external_commands:scripts/lib/specs.mjs:27:process-exec","file":"scripts/lib/specs.mjs","pattern":"Process exec","snippet":"const out = String(exec(\"vm_stat\"));","category":"external_commands","line_end":27,"severity":"high","line_start":27},{"id":"external_commands:scripts/lib/specs.mjs:41:process-exec","file":"scripts/lib/specs.mjs","pattern":"Process exec","snippet":"const out = String(exec(\"cat /proc/meminfo\"));","category":"external_commands","line_end":41,"severity":"high","line_start":41},{"id":"external_commands:scripts/lib/specs.mjs:58:process-exec","file":"scripts/lib/specs.mjs","pattern":"Process exec","snippet":"const out = exec(\"nvidia-smi --query-gpu=memory.total --format=csv,noheader,nounits\");","category":"external_commands","line_end":58,"severity":"high","line_start":58},{"id":"external_commands:audio/scripts/lib/bgm.mjs:148:process-spawn","file":"audio/scripts/lib/bgm.mjs","pattern":"Process spawn","snippet":"const proc = spawn(cmd, args, { detached: true, stdio: [\"ignore\", fd, fd] });","category":"external_commands","line_end":148,"severity":"high","line_start":148},{"id":"external_commands:audio/scripts/lib/bgm.mjs:166:process-spawn","file":"audio/scripts/lib/bgm.mjs","pattern":"Process spawn","snippet":"const proc = spawn(cmd, args, { detached: true, stdio: [\"ignore\", fd, fd] });","category":"external_commands","line_end":166,"severity":"high","line_start":166},{"id":"external_commands:audio/scripts/lib/python.mjs:7:process-spawn","file":"audio/scripts/lib/python.mjs","pattern":"Process spawn","snippet":"// Microsoft Store build adds one). So a bare `spawn(\"python3\", ...)` ENOENTs on a","category":"external_commands","line_end":7,"severity":"high","line_start":7},{"id":"external_commands:audio/scripts/lib/python.test.mjs:6:process-spawn","file":"audio/scripts/lib/python.test.mjs","pattern":"Process spawn","snippet":"// (only `python.exe` + the `py` launcher), so `spawn(\"python3\", ...)` ENOENTs and","category":"external_commands","line_end":6,"severity":"high","line_start":6},{"id":"external_commands:audio/scripts/lib/tts.spawn.test.mjs:12:process-spawn","file":"audio/scripts/lib/tts.spawn.test.mjs","pattern":"Process spawn","snippet":"// Regression: on Windows, npx resolves to npx.cmd, which spawn() cannot exec","category":"external_commands","line_end":12,"severity":"high","line_start":12},{"id":"external_commands:scripts/resolve.test.mjs:85:process-spawn","file":"scripts/resolve.test.mjs","pattern":"Process spawn","snippet":"const child = spawn(process.execPath, [RESOLVE_CLI, ...args], {","category":"external_commands","line_end":85,"severity":"high","line_start":85},{"id":"scripts:audio/scripts/lib/tts.mjs:93:python-exec-function","file":"audio/scripts/lib/tts.mjs","pattern":"Python exec() function","snippet":"const match = /Duration:\\s*(\\d+):(\\d+):(\\d+(?:\\.\\d+)?)/.exec(stderrText ?? \"\");","category":"scripts","line_end":93,"severity":"high","line_start":93},{"id":"scripts:scripts/lib/local-run.mjs:54:python-exec-function","file":"scripts/lib/local-run.mjs","pattern":"Python exec() function","snippet":"exec(fill(model.invoke, vars));","category":"scripts","line_end":54,"severity":"high","line_start":54},{"id":"scripts:scripts/lib/npx-sync.mjs:7:python-exec-function","file":"scripts/lib/npx-sync.mjs","pattern":"Python exec() function","snippet":"// execFileSync/spawnSync cannot exec (spawnSync npx ENOENT) —","category":"scripts","line_end":7,"severity":"high","line_start":7},{"id":"scripts:scripts/lib/specs.mjs:8:python-exec-function","file":"scripts/lib/specs.mjs","pattern":"Python exec() function","snippet":"// `osMod` and `exec` are injectable for tests. `exec(cmd)` returns the command's","category":"scripts","line_end":8,"severity":"high","line_start":8},{"id":"scripts:scripts/lib/specs.mjs:27:python-exec-function","file":"scripts/lib/specs.mjs","pattern":"Python exec() function","snippet":"const out = String(exec(\"vm_stat\"));","category":"scripts","line_end":27,"severity":"high","line_start":27},{"id":"scripts:scripts/lib/specs.mjs:41:python-exec-function","file":"scripts/lib/specs.mjs","pattern":"Python exec() function","snippet":"const out = String(exec(\"cat /proc/meminfo\"));","category":"scripts","line_end":41,"severity":"high","line_start":41},{"id":"scripts:scripts/lib/specs.mjs:58:python-exec-function","file":"scripts/lib/specs.mjs","pattern":"Python exec() function","snippet":"const out = exec(\"nvidia-smi --query-gpu=memory.total --format=csv,noheader,nounits\");","category":"scripts","line_end":58,"severity":"high","line_start":58},{"id":"filesystem:scripts/lib/codex-provider.mjs:68:symlink-creation","file":"scripts/lib/codex-provider.mjs","pattern":"Symlink creation","snippet":"return 'codex CLI not reachable on PATH (a shell alias won\\'t work — spawned processes can\\'t see al","category":"filesystem","line_end":68,"severity":"high","line_start":68},{"id":"external_commands:scripts/eval.mjs:43:synchronous-file-execution","file":"scripts/eval.mjs","pattern":"Synchronous file execution","snippet":"output: execFileSync(process.execPath, [RESOLVE_SCRIPT, ...args], {","category":"external_commands","line_end":43,"severity":"high","line_start":43},{"id":"external_commands:scripts/lib/codex-provider.mjs:46:synchronous-file-execution","file":"scripts/lib/codex-provider.mjs","pattern":"Synchronous file execution","snippet":"return execFileSync(\"codex\", args, {","category":"external_commands","line_end":46,"severity":"high","line_start":46},{"id":"external_commands:scripts/lib/codex-provider.mjs:63:synchronous-file-execution","file":"scripts/lib/codex-provider.mjs","pattern":"Synchronous file execution","snippet":"execFileSync(which, [\"codex\"], { stdio: [\"ignore\", \"ignore\", \"ignore\"], timeout: 5000 });","category":"external_commands","line_end":63,"severity":"high","line_start":63},{"id":"external_commands:scripts/lib/codex-provider.mjs:105:synchronous-file-execution","file":"scripts/lib/codex-provider.mjs","pattern":"Synchronous file execution","snippet":"execFileSync(","category":"external_commands","line_end":105,"severity":"high","line_start":105},{"id":"external_commands:scripts/lib/cube-validate.test.mjs:101:synchronous-file-execution","file":"scripts/lib/cube-validate.test.mjs","pattern":"Synchronous file execution","snippet":"const out = execFileSync(","category":"external_commands","line_end":101,"severity":"high","line_start":101},{"id":"external_commands:scripts/lib/cube-validate.test.mjs:112:synchronous-file-execution","file":"scripts/lib/cube-validate.test.mjs","pattern":"Synchronous file execution","snippet":"execFileSync(","category":"external_commands","line_end":112,"severity":"high","line_start":112},{"id":"external_commands:scripts/lib/cutlist.test.mjs:117:synchronous-file-execution","file":"scripts/lib/cutlist.test.mjs","pattern":"Synchronous file execution","snippet":"const out = execFileSync(","category":"external_commands","line_end":117,"severity":"high","line_start":117},{"id":"external_commands:scripts/lib/duck.test.mjs:100:synchronous-file-execution","file":"scripts/lib/duck.test.mjs","pattern":"Synchronous file execution","snippet":"const out = execFileSync(","category":"external_commands","line_end":100,"severity":"high","line_start":100},{"id":"external_commands:scripts/lib/grade-analyzer.mjs:40:synchronous-file-execution","file":"scripts/lib/grade-analyzer.mjs","pattern":"Synchronous file execution","snippet":"const raw = execFileSync(","category":"external_commands","line_end":40,"severity":"high","line_start":40},{"id":"external_commands:scripts/lib/probe.test.mjs:10:synchronous-process-execution","file":"scripts/lib/probe.test.mjs","pattern":"Synchronous process execution","snippet":"// must NOT execute. Under the old execSync(`ffprobe ... \"${path}\"`) the embedded","category":"external_commands","line_end":10,"severity":"high","line_start":10},{"id":"external_commands:scripts/lib/specs.mjs:15:synchronous-process-execution","file":"scripts/lib/specs.mjs","pattern":"Synchronous process execution","snippet":"return execSync(cmd, { encoding: \"utf8\", stdio: [\"ignore\", \"pipe\", \"ignore\"], timeout: 4000 });","category":"external_commands","line_end":15,"severity":"high","line_start":15},{"id":"external_commands:audio/scripts/lib/bgm.mjs:38:synchronous-spawn","file":"audio/scripts/lib/bgm.mjs","pattern":"Synchronous spawn","snippet":"return spawnSync(cmd, args, { stdio: \"ignore\" }).status === 0;","category":"external_commands","line_end":38,"severity":"high","line_start":38},{"id":"external_commands:audio/scripts/lib/bgm.mjs:48:synchronous-spawn","file":"audio/scripts/lib/bgm.mjs","pattern":"Synchronous spawn","snippet":"return spawnSync(cmd, args, { stdio: \"ignore\" }).status === 0;","category":"external_commands","line_end":48,"severity":"high","line_start":48},{"id":"external_commands:audio/scripts/lib/python.mjs:19:synchronous-spawn","file":"audio/scripts/lib/python.mjs","pattern":"Synchronous spawn","snippet":"return spawnSync(cmd, args, { stdio: \"ignore\" }).status === 0;","category":"external_commands","line_end":19,"severity":"high","line_start":19},{"id":"external_commands:audio/scripts/lib/tts.mjs:30:synchronous-spawn","file":"audio/scripts/lib/tts.mjs","pattern":"Synchronous spawn","snippet":"const r = spawnSync(cmd, args, {","category":"external_commands","line_end":30,"severity":"high","line_start":30},{"id":"external_commands:audio/scripts/lib/tts.mjs:105:synchronous-spawn","file":"audio/scripts/lib/tts.mjs","pattern":"Synchronous spawn","snippet":"const r = spawnSync(\"ffmpeg\", [\"-i\", absPath], { encoding: \"utf8\" });","category":"external_commands","line_end":105,"severity":"high","line_start":105},{"id":"external_commands:audio/scripts/lib/tts.mjs:110:synchronous-spawn","file":"audio/scripts/lib/tts.mjs","pattern":"Synchronous spawn","snippet":"const r = spawnSync(","category":"external_commands","line_end":110,"severity":"high","line_start":110},{"id":"external_commands:audio/scripts/lib/tts.mjs:217:synchronous-spawn","file":"audio/scripts/lib/tts.mjs","pattern":"Synchronous spawn","snippet":"const ff = spawnSync(","category":"external_commands","line_end":217,"severity":"high","line_start":217},{"id":"external_commands:audio/scripts/lib/tts.test.mjs:41:synchronous-spawn","file":"audio/scripts/lib/tts.test.mjs","pattern":"Synchronous spawn","snippet":"// at all) so ffprobeDuration's spawnSync(\"ffprobe\", ...) call ENOENTs for","category":"external_commands","line_end":41,"severity":"high","line_start":41},{"id":"external_commands:scripts/lib/grade-analyzer.test.mjs:13:synchronous-spawn","file":"scripts/lib/grade-analyzer.test.mjs","pattern":"Synchronous spawn","snippet":"spawnSync(\"ffmpeg\", [\"-version\"], { stdio: \"ignore\" }).status === 0","category":"external_commands","line_end":13,"severity":"high","line_start":13},{"id":"external_commands:scripts/lib/heygen-cli.test.mjs:250:synchronous-spawn","file":"scripts/lib/heygen-cli.test.mjs","pattern":"Synchronous spawn","snippet":"const child = spawnSync(","category":"external_commands","line_end":250,"severity":"high","line_start":250},{"id":"external_commands:scripts/resolve.mjs:1093:synchronous-spawn","file":"scripts/resolve.mjs","pattern":"Synchronous spawn","snippet":"return spawnSync(bin, argv, {","category":"external_commands","line_end":1093,"severity":"high","line_start":1093},{"id":"external_commands:scripts/resolve.test.mjs:28:synchronous-spawn","file":"scripts/resolve.test.mjs","pattern":"Synchronous spawn","snippet":"const HAS_FFMPEG = spawnSync(\"ffmpeg\", [\"-version\"], { stdio: \"ignore\" }).status === 0;","category":"external_commands","line_end":28,"severity":"high","line_start":28},{"id":"external_commands:scripts/resolve.test.mjs:33:synchronous-spawn","file":"scripts/resolve.test.mjs","pattern":"Synchronous spawn","snippet":"spawnSync(process.execPath, [\"--import\", \"tsx\", \"--input-type=module\", \"-e\", \"0\"], {","category":"external_commands","line_end":33,"severity":"high","line_start":33},{"id":"external_commands:scripts/resolve.test.mjs:74:synchronous-spawn","file":"scripts/resolve.test.mjs","pattern":"Synchronous spawn","snippet":"return spawnSync(process.execPath, [RESOLVE_CLI, ...args], {","category":"external_commands","line_end":74,"severity":"high","line_start":74},{"id":"scripts:scripts/lib/coverage.test.mjs:47:dynamic-import-expression","file":"scripts/lib/coverage.test.mjs","pattern":"Dynamic import() expression","snippet":"const cutlist = await import(\"./cutlist.mjs\");","category":"scripts","line_end":47,"severity":"medium","line_start":47},{"id":"scripts:scripts/lib/coverage.test.mjs:53:dynamic-import-expression","file":"scripts/lib/coverage.test.mjs","pattern":"Dynamic import() expression","snippet":"const pw = await import(\"./parakeet-words.mjs\");","category":"scripts","line_end":53,"severity":"medium","line_start":53},{"id":"scripts:scripts/lib/coverage.test.mjs:55:dynamic-import-expression","file":"scripts/lib/coverage.test.mjs","pattern":"Dynamic import() expression","snippet":"const lm = await import(\"./local-models.mjs\");","category":"scripts","line_end":55,"severity":"medium","line_start":55},{"id":"scripts:scripts/lib/coverage.test.mjs:65:dynamic-import-expression","file":"scripts/lib/coverage.test.mjs","pattern":"Dynamic import() expression","snippet":"const duck = await import(\"./duck.mjs\");","category":"scripts","line_end":65,"severity":"medium","line_start":65},{"id":"scripts:scripts/lib/coverage.test.mjs:71:dynamic-import-expression","file":"scripts/lib/coverage.test.mjs","pattern":"Dynamic import() expression","snippet":"const cache = await import(\"./cache.mjs\");","category":"scripts","line_end":71,"severity":"medium","line_start":71},{"id":"scripts:scripts/lib/coverage.test.mjs:75:dynamic-import-expression","file":"scripts/lib/coverage.test.mjs","pattern":"Dynamic import() expression","snippet":"const freeze = await import(\"./freeze.mjs\");","category":"scripts","line_end":75,"severity":"medium","line_start":75},{"id":"scripts:scripts/lib/coverage.test.mjs:99:dynamic-import-expression","file":"scripts/lib/coverage.test.mjs","pattern":"Dynamic import() expression","snippet":"const lm = await import(\"./local-models.mjs\");","category":"scripts","line_end":99,"severity":"medium","line_start":99},{"id":"scripts:scripts/lib/coverage.test.mjs:106:dynamic-import-expression","file":"scripts/lib/coverage.test.mjs","pattern":"Dynamic import() expression","snippet":"const lm = await import(\"./local-models.mjs\");","category":"scripts","line_end":106,"severity":"medium","line_start":106},{"id":"scripts:scripts/lib/heygen-video-provider.test.mjs:15:dynamic-import-expression","file":"scripts/lib/heygen-video-provider.test.mjs","pattern":"Dynamic import() expression","snippet":"const module = await import(`./heygen-video-provider.mjs?test=${importCount}`);","category":"scripts","line_end":15,"severity":"medium","line_start":15},{"id":"network:scripts/lib/freeze.test.mjs:20:ftp-protocol","file":"scripts/lib/freeze.test.mjs","pattern":"FTP protocol","snippet":"assert.equal(isDirectMediaUrl(\"ftp://example.com/a.mp4\"), false, \"non-http(s)\");","category":"network","line_end":20,"severity":"medium","line_start":20},{"id":"network:scripts/lib/freeze.test.mjs:27:hardcoded-ip-address","file":"scripts/lib/freeze.test.mjs","pattern":"Hardcoded IP address","snippet":"\"http://127.0.0.1/a.mp4\",","category":"network","line_end":27,"severity":"medium","line_start":27},{"id":"network:scripts/lib/freeze.test.mjs:28:hardcoded-ip-address","file":"scripts/lib/freeze.test.mjs","pattern":"Hardcoded IP address","snippet":"\"http://127.1.2.3/a.mp4\",","category":"network","line_end":28,"severity":"medium","line_start":28},{"id":"network:scripts/lib/freeze.test.mjs:29:hardcoded-ip-address","file":"scripts/lib/freeze.test.mjs","pattern":"Hardcoded IP address","snippet":"\"http://0.0.0.0/a.mp4\",","category":"network","line_end":29,"severity":"medium","line_start":29},{"id":"network:scripts/lib/freeze.test.mjs:30:hardcoded-ip-address","file":"scripts/lib/freeze.test.mjs","pattern":"Hardcoded IP address","snippet":"\"http://10.0.0.5/a.mp4\",","category":"network","line_end":30,"severity":"medium","line_start":30},{"id":"network:scripts/lib/freeze.test.mjs:31:hardcoded-ip-address","file":"scripts/lib/freeze.test.mjs","pattern":"Hardcoded IP address","snippet":"\"http://192.168.1.1/a.mp4\",","category":"network","line_end":31,"severity":"medium","line_start":31},{"id":"network:scripts/lib/freeze.test.mjs:32:hardcoded-ip-address","file":"scripts/lib/freeze.test.mjs","pattern":"Hardcoded IP address","snippet":"\"http://172.16.0.1/a.mp4\",","category":"network","line_end":32,"severity":"medium","line_start":32},{"id":"network:scripts/lib/freeze.test.mjs:33:hardcoded-ip-address","file":"scripts/lib/freeze.test.mjs","pattern":"Hardcoded IP address","snippet":"\"http://172.31.255.255/a.mp4\",","category":"network","line_end":33,"severity":"medium","line_start":33},{"id":"network:scripts/lib/freeze.test.mjs:34:hardcoded-ip-address","file":"scripts/lib/freeze.test.mjs","pattern":"Hardcoded IP address","snippet":"\"http://169.254.169.254/a.mp4\", // cloud metadata endpoint","category":"network","line_end":34,"severity":"medium","line_start":34},{"id":"network:scripts/lib/freeze.test.mjs:44:hardcoded-ip-address","file":"scripts/lib/freeze.test.mjs","pattern":"Hardcoded IP address","snippet":"assert.equal(isDirectMediaUrl(\"https://172.40.0.1/a.mp4\"), true, \"172.40 is public\");","category":"network","line_end":44,"severity":"medium","line_start":44},{"id":"filesystem:audio/references/bgm.md:5:hidden-file-access","file":"audio/references/bgm.md","pattern":"Hidden file access","snippet":"- **HeyGen retrieval — the default when credentialed.** Search HeyGen's music catalog by mood, downl","category":"filesystem","line_end":5,"severity":"medium","line_start":5},{"id":"filesystem:audio/references/captions/transcript-handling.md:54:hidden-file-access","file":"audio/references/captions/transcript-handling.md","pattern":"Hidden file access","snippet":"if (/^[♪�\\u266a\\u266b\\u266c\\u266d\\u266e\\u266f]+$/.test(w.text)) return false;","category":"filesystem","line_end":54,"severity":"medium","line_start":54},{"id":"filesystem:audio/references/requirements.md:9:hidden-file-access","file":"audio/references/requirements.md","pattern":"Hidden file access","snippet":"| **HeyGen** (TTS + BGM/SFX retrieval) | `$HEYGEN_API_KEY` → `$HYPERFRAMES_API_KEY` → `~/.heygen/cre","category":"filesystem","line_end":9,"severity":"medium","line_start":9},{"id":"filesystem:audio/references/requirements.md:19:hidden-file-access","file":"audio/references/requirements.md","pattern":"Hidden file access","snippet":"Each command downloads its own model on first run and caches it under `~/.cache/hyperframes/`:","category":"filesystem","line_end":19,"severity":"medium","line_start":19},{"id":"filesystem:audio/references/requirements.md:21:hidden-file-access","file":"audio/references/requirements.md","pattern":"Hidden file access","snippet":"- **TTS (HeyGen)** — no local deps; needs a HeyGen credential + `ffmpeg` on PATH (to transcode the m","category":"filesystem","line_end":21,"severity":"medium","line_start":21},{"id":"filesystem:audio/references/requirements.md:25:hidden-file-access","file":"audio/references/requirements.md","pattern":"Hidden file access","snippet":"- **BGM (MusicGen)** — `pip install transformers torch soundfile`. `facebook/musicgen-small` (~300 M","category":"filesystem","line_end":25,"severity":"medium","line_start":25},{"id":"filesystem:audio/references/tts.md:13:hidden-file-access","file":"audio/references/tts.md","pattern":"Hidden file access","snippet":"| 1     | HeyGen (Starfish) | `$HEYGEN_API_KEY` / `~/.heygen/credentials` | UUIDs from `GET /v3/voic","category":"filesystem","line_end":13,"severity":"medium","line_start":13},{"id":"filesystem:audio/references/tts.md:31:hidden-file-access","file":"audio/references/tts.md","pattern":"Hidden file access","snippet":"walks up ≤5 dirs) → `~/.heygen/credentials` (shared with heygen-cli;","category":"filesystem","line_end":31,"severity":"medium","line_start":31},{"id":"filesystem:audio/scripts/audio.test.mjs:45:hidden-file-access","file":"audio/scripts/audio.test.mjs","pattern":"Hidden file access","snippet":"assert.ok(anomalies.some((a) => /not in bundled library/.test(a)));","category":"filesystem","line_end":45,"severity":"medium","line_start":45},{"id":"filesystem:references/operations.md:78:hidden-file-access","file":"references/operations.md","pattern":"Hidden file access","snippet":"# install once: uv venv ~/.venvs/parakeet && VIRTUAL_ENV=~/.venvs/parakeet uv pip install parakeet-m","category":"filesystem","line_end":78,"severity":"medium","line_start":78},{"id":"filesystem:references/telemetry-dashboard.md:8:hidden-file-access","file":"references/telemetry-dashboard.md","pattern":"Hidden file access","snippet":"`.media/` + `~/.media`, no PostHog access needed).","category":"filesystem","line_end":8,"severity":"medium","line_start":8},{"id":"filesystem:references/telemetry-dashboard.md:13:hidden-file-access","file":"references/telemetry-dashboard.md","pattern":"Hidden file access","snippet":"— the shared install id in `~/.hyperframes/config.json` (`anonymousId`), stitched","category":"filesystem","line_end":13,"severity":"medium","line_start":13},{"id":"filesystem:scripts/lib/brand-provider.mjs:27:hidden-file-access","file":"scripts/lib/brand-provider.mjs","pattern":"Hidden file access","snippet":"if (typeof v === \"string\" && /^#[0-9a-fA-F]{3,8}$/.test(v)) {","category":"filesystem","line_end":27,"severity":"medium","line_start":27},{"id":"filesystem:scripts/lib/cache.mjs:34:hidden-file-access","file":"scripts/lib/cache.mjs","pattern":"Hidden file access","snippet":"// the latter nested it at ~/.media/.media/manifest.jsonl, invisible to the","category":"filesystem","line_end":34,"severity":"medium","line_start":34},{"id":"filesystem:scripts/lib/candidates.mjs:2:hidden-file-access","file":"scripts/lib/candidates.mjs","pattern":"Hidden file access","snippet":"// project (its own manifest) and across every project (the global ~/.media","category":"filesystem","line_end":2,"severity":"medium","line_start":2},{"id":"filesystem:scripts/lib/candidates.test.mjs:10:hidden-file-access","file":"scripts/lib/candidates.test.mjs","pattern":"Hidden file access","snippet":"// to a temp dir and seed a fake global ~/.media manifest deterministically.","category":"filesystem","line_end":10,"severity":"medium","line_start":10},{"id":"filesystem:scripts/lib/codex-provider.mjs:68:hidden-file-access","file":"scripts/lib/codex-provider.mjs","pattern":"Hidden file access","snippet":"return 'codex CLI not reachable on PATH (a shell alias won\\'t work — spawned processes can\\'t see al","category":"filesystem","line_end":68,"severity":"medium","line_start":68},{"id":"filesystem:scripts/lib/codex-provider.mjs:81:hidden-file-access","file":"scripts/lib/codex-provider.mjs","pattern":"Hidden file access","snippet":"if (!/\\bimage_generation\\b/.test(feats)) return \"codex image_generation feature unavailable\";","category":"filesystem","line_end":81,"severity":"medium","line_start":81},{"id":"filesystem:scripts/lib/codex-provider.mjs:82:hidden-file-access","file":"scripts/lib/codex-provider.mjs","pattern":"Hidden file access","snippet":"if (!/\\bimagegenext\\b/.test(feats)) return \"codex imagegenext unavailable (upgrade Codex CLI)\";","category":"filesystem","line_end":82,"severity":"medium","line_start":82},{"id":"filesystem:scripts/lib/cube-build.mjs:143:hidden-file-access","file":"scripts/lib/cube-build.mjs","pattern":"Hidden file access","snippet":"if (/\\b(warm|golden|sunlit|sunny)\\b/.test(text)) {","category":"filesystem","line_end":143,"severity":"medium","line_start":143},{"id":"filesystem:scripts/lib/cube-build.mjs:146:hidden-file-access","file":"scripts/lib/cube-build.mjs","pattern":"Hidden file access","snippet":"} else if (/\\b(cool|blue|icy|crisp)\\b/.test(text)) {","category":"filesystem","line_end":146,"severity":"medium","line_start":146},{"id":"filesystem:SKILL.md:37:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"| No cross-project memory                    | global content-addressed cache + auto-promote (`~/.me","category":"filesystem","line_end":37,"severity":"medium","line_start":37},{"id":"filesystem:SKILL.md:138:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"| `--stats`       | Print local usage stats from `.media/` and `~/.media`; no manifest changes      ","category":"filesystem","line_end":138,"severity":"medium","line_start":138},{"id":"filesystem:SKILL.md:283:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"3. Check global cache `~/.media/` for a reusable asset matched on the same normalized prompt — auto-","category":"filesystem","line_end":283,"severity":"medium","line_start":283},{"id":"filesystem:SKILL.md:285:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"5. Freeze file to `.media/<type>/`, register in manifest, regenerate `index.md`, auto-promote to `~/","category":"filesystem","line_end":285,"severity":"medium","line_start":285},{"id":"filesystem:SKILL.md:318:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"Assets are cached automatically on resolve. Every resolved/ingested asset is auto-promoted to the gl","category":"filesystem","line_end":318,"severity":"medium","line_start":318},{"id":"filesystem:SKILL.md:324:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"The lightweight tier of user memory: confirmed brief answers (destination, aspect, language, flow, s","category":"filesystem","line_end":324,"severity":"medium","line_start":324},{"id":"filesystem:SKILL.md:336:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"The heavyweight tier of user memory: one approved run frozen as a named, versioned bundle — `frame.m","category":"filesystem","line_end":336,"severity":"medium","line_start":336},{"id":"filesystem:SKILL.md:348:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"Use `resolve --stats` for a local, shareable report over the current project's `.media/` manifest, t","category":"filesystem","line_end":348,"severity":"medium","line_start":348},{"id":"filesystem:SKILL.md:363:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"- `~/.media/`: global cross-project reuse cache (content-addressed, SHA-256)","category":"filesystem","line_end":363,"severity":"medium","line_start":363},{"id":"external_commands:audio/references/captions/authoring.md:92:ruby-shell-backtick-execution","file":"audio/references/captions/authoring.md","pattern":"Ruby/shell backtick execution","snippet":"// `tl.set` is an instant flip, not a tween — safe to set `visibility` here (core's \"no animating","category":"external_commands","line_end":92,"severity":"medium","line_start":92},{"id":"external_commands:audio/references/tts.md:40:ruby-shell-backtick-execution","file":"audio/references/tts.md","pattern":"Ruby/shell backtick execution","snippet":"# Only needed if you haven't run `npx hyperframes auth login`:","category":"external_commands","line_end":49,"severity":"medium","line_start":40},{"id":"external_commands:audio/scripts/audio.mjs:4:ruby-shell-backtick-execution","file":"audio/scripts/audio.mjs","pattern":"Ruby/shell backtick execution","snippet":"// ...). Workflows do NOT vendor a copy: they write a neutral `audio_request.json`","category":"external_commands","line_end":4,"severity":"medium","line_start":4},{"id":"external_commands:audio/scripts/audio.mjs:61:ruby-shell-backtick-execution","file":"audio/scripts/audio.mjs","pattern":"Ruby/shell backtick execution","snippet":"const i = argv.indexOf(`--${name}`);","category":"external_commands","line_end":61,"severity":"medium","line_start":61},{"id":"external_commands:audio/scripts/audio.mjs:64:ruby-shell-backtick-execution","file":"audio/scripts/audio.mjs","pattern":"Ruby/shell backtick execution","snippet":"const has = (name) => argv.includes(`--${name}`);","category":"external_commands","line_end":64,"severity":"medium","line_start":64},{"id":"external_commands:audio/scripts/audio.mjs:66:ruby-shell-backtick-execution","file":"audio/scripts/audio.mjs","pattern":"Ruby/shell backtick execution","snippet":"console.error(`✗ audio engine: ${m}`);","category":"external_commands","line_end":66,"severity":"medium","line_start":66},{"id":"external_commands:audio/scripts/audio.mjs:101:ruby-shell-backtick-execution","file":"audio/scripts/audio.mjs","pattern":"Ruby/shell backtick execution","snippet":"if (!existsSync(requestPath)) die(`audio_request.json not found at ${requestPath}`);","category":"external_commands","line_end":101,"severity":"medium","line_start":101},{"id":"external_commands:audio/scripts/audio.mjs:106:ruby-shell-backtick-execution","file":"audio/scripts/audio.mjs","pattern":"Ruby/shell backtick execution","snippet":"die(`audio_request.json parse: ${e.message}`);","category":"external_commands","line_end":106,"severity":"medium","line_start":106},{"id":"external_commands:audio/scripts/audio.mjs:138:ruby-shell-backtick-execution","file":"audio/scripts/audio.mjs","pattern":"Ruby/shell backtick execution","snippet":"console.error(`· tts: ${ttsProvider} · voice ${voiceId} · ${lines.length} line(s)`);","category":"external_commands","line_end":138,"severity":"medium","line_start":138},{"id":"external_commands:luts/index.json:2:ruby-shell-backtick-execution","file":"luts/index.json","pattern":"Ruby/shell backtick execution","snippet":"\"notes\": \"Look entries resolve on-demand from a CDN .cube `url` (downloaded + frozen, like bgm/image","category":"external_commands","line_end":2,"severity":"medium","line_start":2},{"id":"external_commands:scripts/audio-duck.mjs:28:ruby-shell-backtick-execution","file":"scripts/audio-duck.mjs","pattern":"Ruby/shell backtick execution","snippet":"console.log(`media-use audio-duck — generate GSAP volume ducking keyframes","category":"external_commands","line_end":45,"severity":"medium","line_start":28},{"id":"external_commands:scripts/audio-duck.mjs:54:ruby-shell-backtick-execution","file":"scripts/audio-duck.mjs","pattern":"Ruby/shell backtick execution","snippet":"else console.error(`error: ${err.message}`);","category":"external_commands","line_end":54,"severity":"medium","line_start":54},{"id":"external_commands:scripts/audio-duck.mjs:90:ruby-shell-backtick-execution","file":"scripts/audio-duck.mjs","pattern":"Ruby/shell backtick execution","snippet":"`// auto-duck: ${target} under narration (generated; base volume ${fmt(baseVolume)})`,","category":"external_commands","line_end":90,"severity":"medium","line_start":90},{"id":"external_commands:scripts/audio-duck.mjs:94:ruby-shell-backtick-execution","file":"scripts/audio-duck.mjs","pattern":"Ruby/shell backtick execution","snippet":"`tl.to(${JSON.stringify(target)}, { volume: ${fmt(keyframe.volume)}, duration: ${fmt(","category":"external_commands","line_end":96,"severity":"medium","line_start":94},{"id":"external_commands:scripts/audio-duck.mjs:107:ruby-shell-backtick-execution","file":"scripts/audio-duck.mjs","pattern":"Ruby/shell backtick execution","snippet":"const tag = html.match(new RegExp(`<[^>]*\\\\bid=[\"']${escapeRegExp(id)}[\"'][^>]*>`, \"i\"))?.[0];","category":"external_commands","line_end":107,"severity":"medium","line_start":107},{"id":"external_commands:scripts/eval.mjs:61:ruby-shell-backtick-execution","file":"scripts/eval.mjs","pattern":"Ruby/shell backtick execution","snippet":"const rel = base ? `${base}/${e.name}` : e.name;","category":"external_commands","line_end":61,"severity":"medium","line_start":61},{"id":"external_commands:scripts/eval.mjs:75:ruby-shell-backtick-execution","file":"scripts/eval.mjs","pattern":"Ruby/shell backtick execution","snippet":"const tmp = mkdtempSync(join(tmpdir(), `mu-eval-${name}-`));","category":"external_commands","line_end":75,"severity":"medium","line_start":75},{"id":"external_commands:scripts/eval.mjs:203:ruby-shell-backtick-execution","file":"scripts/eval.mjs","pattern":"Ruby/shell backtick execution","snippet":"return `<tr>","category":"external_commands","line_end":210,"severity":"medium","line_start":203},{"id":"external_commands:scripts/eval.mjs:220:ruby-shell-backtick-execution","file":"scripts/eval.mjs","pattern":"Ruby/shell backtick execution","snippet":"const dur = m.duration != null ? `${m.duration}s` : \"—\";","category":"external_commands","line_end":220,"severity":"medium","line_start":220},{"id":"external_commands:SKILL.md:3:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"description: Agent Media OS, the single skill for every media need in a HyperFrames project. Resolve","category":"external_commands","line_end":3,"severity":"medium","line_start":3},{"id":"external_commands:SKILL.md:12:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":16,"severity":"medium","line_start":12},{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":18,"severity":"medium","line_start":16},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"This unlocks the FREE path for bgm/sfx/image/icon catalog search, TTS (voice), and avatar videos. Si","category":"external_commands","line_end":18,"severity":"medium","line_start":18},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":22,"severity":"medium","line_start":20},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":26,"severity":"medium","line_start":22},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"HyperFrames owns media _playback_; media-use owns everything else. Each row is enforced by `scripts/","category":"external_commands","line_end":30,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Audio-only, no image/icon                  | `resolve --type image\\|icon` (heygen asset search)   ","category":"external_commands","line_end":31,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| No third-party brand logos                 | `resolve --type logo` (svgl → simple-icons → GitHub o","category":"external_commands","line_end":32,"severity":"medium","line_start":31},{"id":"scripts:scripts/lib/manifest.mjs:124:sharedarraybuffer-spectre-risk","file":"scripts/lib/manifest.mjs","pattern":"SharedArrayBuffer (Spectre risk)","snippet":"Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);","category":"scripts","line_end":124,"severity":"medium","line_start":124},{"id":"external_commands:scripts/lib/codex-provider.mjs:68:shell-command-substitution","file":"scripts/lib/codex-provider.mjs","pattern":"Shell command substitution","snippet":"return 'codex CLI not reachable on PATH (a shell alias won\\'t work — spawned processes can\\'t see al","category":"external_commands","line_end":68,"severity":"medium","line_start":68},{"id":"filesystem:audio/scripts/audio.mjs:42:synchronous-file-operations","file":"audio/scripts/audio.mjs","pattern":"Synchronous file operations","snippet":"import { existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";","category":"filesystem","line_end":42,"severity":"medium","line_start":42},{"id":"filesystem:audio/scripts/audio.mjs:104:synchronous-file-operations","file":"audio/scripts/audio.mjs","pattern":"Synchronous file operations","snippet":"request = JSON.parse(readFileSync(requestPath, \"utf8\"));","category":"filesystem","line_end":104,"severity":"medium","line_start":104},{"id":"filesystem:audio/scripts/audio.mjs:118:synchronous-file-operations","file":"audio/scripts/audio.mjs","pattern":"Synchronous file operations","snippet":"const prev = existsSync(outPath) ? JSON.parse(readFileSync(outPath, \"utf8\")) : {};","category":"filesystem","line_end":118,"severity":"medium","line_start":118},{"id":"filesystem:audio/scripts/audio.mjs:282:synchronous-file-operations","file":"audio/scripts/audio.mjs","pattern":"Synchronous file operations","snippet":"writeFileSync(outPath, JSON.stringify(meta, null, 2));","category":"filesystem","line_end":282,"severity":"medium","line_start":282},{"id":"filesystem:audio/scripts/heygen-tts.mjs:18:synchronous-file-operations","file":"audio/scripts/heygen-tts.mjs","pattern":"Synchronous file operations","snippet":"import { existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";","category":"filesystem","line_end":18,"severity":"medium","line_start":18},{"id":"filesystem:audio/scripts/heygen-tts.mjs:89:synchronous-file-operations","file":"audio/scripts/heygen-tts.mjs","pattern":"Synchronous file operations","snippet":"? readFileSync(resolve(positional), \"utf8\").trim()","category":"filesystem","line_end":89,"severity":"medium","line_start":89},{"id":"filesystem:audio/scripts/heygen-tts.mjs:112:synchronous-file-operations","file":"audio/scripts/heygen-tts.mjs","pattern":"Synchronous file operations","snippet":"writeFileSync(wordsPath, JSON.stringify(withWordIds(words), null, 2));","category":"filesystem","line_end":112,"severity":"medium","line_start":112},{"id":"filesystem:audio/scripts/lib/heygen.mjs:7:synchronous-file-operations","file":"audio/scripts/lib/heygen.mjs","pattern":"Synchronous file operations","snippet":"import { existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";","category":"filesystem","line_end":7,"severity":"medium","line_start":7},{"id":"filesystem:audio/scripts/lib/heygen.mjs:25:synchronous-file-operations","file":"audio/scripts/lib/heygen.mjs","pattern":"Synchronous file operations","snippet":"for (const raw of readFileSync(envPath, \"utf8\").split(\"\\n\")) {","category":"filesystem","line_end":25,"severity":"medium","line_start":25},{"id":"filesystem:scripts/audio-duck.mjs:3:synchronous-file-operations","file":"scripts/audio-duck.mjs","pattern":"Synchronous file operations","snippet":"import { readFileSync } from \"node:fs\";","category":"filesystem","line_end":3,"severity":"medium","line_start":3},{"id":"filesystem:scripts/audio-duck.mjs:60:synchronous-file-operations","file":"scripts/audio-duck.mjs","pattern":"Synchronous file operations","snippet":"const meta = JSON.parse(readFileSync(resolve(args.meta), \"utf8\"));","category":"filesystem","line_end":60,"severity":"medium","line_start":60},{"id":"filesystem:scripts/audio-duck.mjs:104:synchronous-file-operations","file":"scripts/audio-duck.mjs","pattern":"Synchronous file operations","snippet":"const html = readFileSync(resolve(composition), \"utf8\");","category":"filesystem","line_end":104,"severity":"medium","line_start":104},{"id":"filesystem:scripts/eval.mjs:12:synchronous-file-operations","file":"scripts/eval.mjs","pattern":"Synchronous file operations","snippet":"readFileSync,","category":"filesystem","line_end":12,"severity":"medium","line_start":12},{"id":"filesystem:scripts/eval.mjs:15:synchronous-file-operations","file":"scripts/eval.mjs","pattern":"Synchronous file operations","snippet":"writeFileSync,","category":"filesystem","line_end":15,"severity":"medium","line_start":15},{"id":"filesystem:scripts/eval.mjs:87:synchronous-file-operations","file":"scripts/eval.mjs","pattern":"Synchronous file operations","snippet":"const html = readFileSync(join(tmp, hf), \"utf8\");","category":"filesystem","line_end":87,"severity":"medium","line_start":87},{"id":"filesystem:scripts/eval.mjs:116:synchronous-file-operations","file":"scripts/eval.mjs","pattern":"Synchronous file operations","snippet":"? readFileSync(indexPath, \"utf8\")","category":"filesystem","line_end":116,"severity":"medium","line_start":116},{"id":"filesystem:scripts/eval.mjs:122:synchronous-file-operations","file":"scripts/eval.mjs","pattern":"Synchronous file operations","snippet":"? readFileSync(manifestPath, \"utf8\")","category":"filesystem","line_end":122,"severity":"medium","line_start":122},{"id":"filesystem:scripts/eval.mjs:368:synchronous-file-operations","file":"scripts/eval.mjs","pattern":"Synchronous file operations","snippet":"writeFileSync(outPath, report);","category":"filesystem","line_end":368,"severity":"medium","line_start":368},{"id":"filesystem:audio/scripts/lib/tts.test.mjs:99:temp-directory-access","file":"audio/scripts/lib/tts.test.mjs","pattern":"Temp directory access","snippet":"{ text: \"hi\", voiceId: \"v1\", lang: \"en\", speed: 1, wavAbs: \"/tmp/x.wav\" },","category":"filesystem","line_end":99,"severity":"medium","line_start":99},{"id":"filesystem:audio/scripts/lib/tts.test.mjs:114:temp-directory-access","file":"audio/scripts/lib/tts.test.mjs","pattern":"Temp directory access","snippet":"{ text: \"hi\", voiceId: \"v1\", lang: \"en\", speed: 1, wavAbs: \"/tmp/x.wav\" },","category":"filesystem","line_end":114,"severity":"medium","line_start":114},{"id":"filesystem:audio/scripts/lib/tts.test.mjs:127:temp-directory-access","file":"audio/scripts/lib/tts.test.mjs","pattern":"Temp directory access","snippet":"{ text: \"hi\", voiceId: \"v1\", lang: \"en\", speed: 1, wavAbs: \"/tmp/x.wav\" },","category":"filesystem","line_end":127,"severity":"medium","line_start":127},{"id":"filesystem:audio/scripts/lib/tts.test.mjs:154:temp-directory-access","file":"audio/scripts/lib/tts.test.mjs","pattern":"Temp directory access","snippet":"const res = synthResult({ status: 2 }, \"/tmp/none.wav\", \"kokoro (npx hyperframes tts)\");","category":"filesystem","line_end":154,"severity":"medium","line_start":154},{"id":"filesystem:scripts/lib/grade-analyzer.test.mjs:144:temp-directory-access","file":"scripts/lib/grade-analyzer.test.mjs","pattern":"Temp directory access","snippet":"const note = formatMeasuredNote(\"/tmp/frame.png\", {","category":"filesystem","line_end":144,"severity":"medium","line_start":144},{"id":"filesystem:scripts/lib/local-run.test.mjs:21:temp-directory-access","file":"scripts/lib/local-run.test.mjs","pattern":"Temp directory access","snippet":"vars: { text: \"hi\", out: \"/tmp/v.wav\" },","category":"filesystem","line_end":21,"severity":"medium","line_start":21},{"id":"filesystem:scripts/lib/local-run.test.mjs:36:temp-directory-access","file":"scripts/lib/local-run.test.mjs","pattern":"Temp directory access","snippet":"vars: { text: \"hello world\", voice: \"af_heart\", out: \"/tmp/v.wav\" },","category":"filesystem","line_end":36,"severity":"medium","line_start":36},{"id":"filesystem:scripts/lib/local-run.test.mjs:39:temp-directory-access","file":"scripts/lib/local-run.test.mjs","pattern":"Temp directory access","snippet":"assert.equal(r.out, \"/tmp/v.wav\");","category":"filesystem","line_end":39,"severity":"medium","line_start":39},{"id":"external_commands:scripts/lib/codex-provider.mjs:65:template-literal-with-command-substitution","file":"scripts/lib/codex-provider.mjs","pattern":"Template literal with command substitution","snippet":"// A shell alias (e.g. `codex → /Applications/Codex.app/...`) is NOT enough:","category":"external_commands","line_end":70,"severity":"medium","line_start":65},{"id":"external_commands:audio/scripts/lib/tts.test.mjs:49:unix-shell-invocation","file":"audio/scripts/lib/tts.test.mjs","pattern":"Unix shell invocation","snippet":"\"#!/bin/sh\\necho 'Duration: 00:00:02.50, start: 0.000000, bitrate: 128 kb/s' 1>&2\\nexit 1\\n\",","category":"external_commands","line_end":49,"severity":"medium","line_start":49},{"id":"external_commands:scripts/lib/heygen-search.test.mjs:19:unix-shell-invocation","file":"scripts/lib/heygen-search.test.mjs","pattern":"Unix shell invocation","snippet":"`#!/bin/sh","category":"external_commands","line_end":19,"severity":"medium","line_start":19},{"id":"external_commands:scripts/lib/heygen-video-provider.test.mjs:74:unix-shell-invocation","file":"scripts/lib/heygen-video-provider.test.mjs","pattern":"Unix shell invocation","snippet":"`#!/bin/sh","category":"external_commands","line_end":74,"severity":"medium","line_start":74},{"id":"external_commands:scripts/lib/voice-provider.test.mjs:17:unix-shell-invocation","file":"scripts/lib/voice-provider.test.mjs","pattern":"Unix shell invocation","snippet":"`#!/bin/sh","category":"external_commands","line_end":17,"severity":"medium","line_start":17},{"id":"external_commands:scripts/resolve.test.mjs:197:unix-shell-invocation","file":"scripts/resolve.test.mjs","pattern":"Unix shell invocation","snippet":"writeFileSync(command, `#!/bin/sh\\n${body}\\nexit ${exitCode}\\n`);","category":"external_commands","line_end":197,"severity":"medium","line_start":197},{"id":"blocker:audio/scripts/lib/tts.mjs:73:network-reconnaissance","file":"audio/scripts/lib/tts.mjs","pattern":"Network reconnaissance","snippet":"if (!pick) throw new Error(\"no public starfish voice to default to — pass --voice\");","category":"blocker","line_end":73,"severity":"low","line_start":73},{"id":"blocker:scripts/lib/duck.mjs:19:network-reconnaissance","file":"scripts/lib/duck.mjs","pattern":"Network reconnaissance","snippet":"\"audio_meta has multiple voice lines with file-relative times; pass --sequential or --offsets so spa","category":"blocker","line_end":19,"severity":"low","line_start":19},{"id":"blocker:scripts/lib/prefs-store.mjs:162:network-reconnaissance","file":"scripts/lib/prefs-store.mjs","pattern":"Network reconnaissance","snippet":"throw new Error(\"style_preset is stored per workflow — pass --workflow <w>\");","category":"blocker","line_end":162,"severity":"low","line_start":162},{"id":"blocker:scripts/lib/prefs-store.test.mjs:166:network-reconnaissance","file":"scripts/lib/prefs-store.test.mjs","pattern":"Network reconnaissance","snippet":"/pass --workflow/,","category":"blocker","line_end":166,"severity":"low","line_start":166},{"id":"blocker:scripts/lib/registry.mjs:59:network-reconnaissance","file":"scripts/lib/registry.mjs","pattern":"Network reconnaissance","snippet":"// Catalog miss -> generate. Local first (best FLUX-class model the machine's","category":"blocker","line_end":59,"severity":"low","line_start":59},{"id":"blocker:scripts/transcript-cut.mjs:83:network-reconnaissance","file":"scripts/transcript-cut.mjs","pattern":"Network reconnaissance","snippet":"throw new Error(\"--input and --out are required unless --plan is set\");","category":"blocker","line_end":83,"severity":"low","line_start":83},{"id":"blocker:audio/references/remove-background.md:93:system-reconnaissance","file":"audio/references/remove-background.md","pattern":"System reconnaissance","snippet":"Both share the same `--quality` and run from a single inference pass — only encode cost roughly doub","category":"blocker","line_end":93,"severity":"low","line_start":93},{"id":"blocker:audio/references/tts.md:35:system-reconnaissance","file":"audio/references/tts.md","pattern":"System reconnaissance","snippet":"(10 min/month) before paid usage; API keys follow normal API billing. If the","category":"blocker","line_end":35,"severity":"low","line_start":35},{"id":"blocker:audio/references/tts.md:51:system-reconnaissance","file":"audio/references/tts.md","pattern":"System reconnaissance","snippet":"- **Voice:** `--voice <id>` must be a **starfish** voice_id (`--list`, or `GET /v3/voices?engine=sta","category":"blocker","line_end":51,"severity":"low","line_start":51},{"id":"blocker:audio/references/tts.md:108:system-reconnaissance","file":"audio/references/tts.md","pattern":"System reconnaissance","snippet":"Valid `--lang` codes (only needed to override the voice's auto-detected language): `en-us`, `en-gb`,","category":"blocker","line_end":108,"severity":"low","line_start":108},{"id":"blocker:audio/scripts/audio.mjs:20:system-reconnaissance","file":"audio/scripts/audio.mjs","pattern":"System reconnaissance","snippet":"//     \"lines\": [                   // one TTS unit each; id joins back to the caller's model","category":"blocker","line_end":20,"severity":"low","line_start":20},{"id":"blocker:audio/scripts/audio.mjs:124:system-reconnaissance","file":"audio/scripts/audio.mjs","pattern":"System reconnaissance","snippet":"let voiceId = prev.voice_id ?? null;","category":"blocker","line_end":124,"severity":"low","line_start":124},{"id":"blocker:audio/scripts/audio.mjs:140:system-reconnaissance","file":"audio/scripts/audio.mjs","pattern":"System reconnaissance","snippet":"const id = String(line.id);","category":"blocker","line_end":140,"severity":"low","line_start":140},{"id":"blocker:audio/scripts/audio.mjs:183:system-reconnaissance","file":"audio/scripts/audio.mjs","pattern":"System reconnaissance","snippet":"bgm_pid: prev.bgm_pid ?? null,","category":"blocker","line_end":183,"severity":"low","line_start":183},{"id":"blocker:audio/scripts/audio.mjs:244:system-reconnaissance","file":"audio/scripts/audio.mjs","pattern":"System reconnaissance","snippet":"bgmFields.bgm_pid = gen.pid;","category":"blocker","line_end":244,"severity":"low","line_start":244},{"id":"blocker:references/telemetry-dashboard.md:13:system-reconnaissance","file":"references/telemetry-dashboard.md","pattern":"System reconnaissance","snippet":"— the shared install id in `~/.hyperframes/config.json` (`anonymousId`), stitched","category":"blocker","line_end":13,"severity":"low","line_start":13},{"id":"blocker:scripts/audio-duck.mjs:42:system-reconnaissance","file":"scripts/audio-duck.mjs","pattern":"System reconnaissance","snippet":"--offsets       Explicit placement, \"l1=0,l2=3.4\" (voice id = start seconds)","category":"blocker","line_end":42,"severity":"low","line_start":42},{"id":"blocker:scripts/audio-duck.mjs:103:system-reconnaissance","file":"scripts/audio-duck.mjs","pattern":"System reconnaissance","snippet":"const id = target.slice(1);","category":"blocker","line_end":103,"severity":"low","line_start":103},{"id":"blocker:scripts/eval.mjs:285:system-reconnaissance","file":"scripts/eval.mjs","pattern":"System reconnaissance","snippet":".stat { background: var(--surface); border: 1px solid var(--border); border-radius: 8px; padding: 14","category":"blocker","line_end":285,"severity":"low","line_start":285},{"id":"blocker:scripts/eval.mjs:289:system-reconnaissance","file":"scripts/eval.mjs","pattern":"System reconnaissance","snippet":"th { text-align: left; font-family: var(--mono); font-size: 10px; letter-spacing: .08em; text-transf","category":"blocker","line_end":289,"severity":"low","line_start":289},{"id":"blocker:scripts/eval.mjs:290:system-reconnaissance","file":"scripts/eval.mjs","pattern":"System reconnaissance","snippet":"td { border-bottom: 1px solid var(--border); padding: 7px 8px; vertical-align: top }","category":"blocker","line_end":290,"severity":"low","line_start":290},{"id":"blocker:scripts/eval.mjs:295:system-reconnaissance","file":"scripts/eval.mjs","pattern":"System reconnaissance","snippet":".col { background: var(--surface); border: 1px solid var(--border); border-radius: 8px; padding: 14p","category":"blocker","line_end":295,"severity":"low","line_start":295},{"id":"blocker:scripts/eval.mjs:298:system-reconnaissance","file":"scripts/eval.mjs","pattern":"System reconnaissance","snippet":"pre.file-list { background: var(--bg); color: var(--muted); border: 1px solid var(--border) }","category":"blocker","line_end":298,"severity":"low","line_start":298},{"id":"blocker:scripts/eval.mjs:300:system-reconnaissance","file":"scripts/eval.mjs","pattern":"System reconnaissance","snippet":".block-detail { border-top: 1px solid var(--border); padding-top: 20px; margin-top: 20px }","category":"blocker","line_end":300,"severity":"low","line_start":300},{"id":"blocker:scripts/eval.mjs:302:system-reconnaissance","file":"scripts/eval.mjs","pattern":"System reconnaissance","snippet":".verdict.ship { background: #edfbf0; border: 1px solid #1a7a3a; color: #1a7a3a }","category":"blocker","line_end":302,"severity":"low","line_start":302},{"id":"blocker:SKILL.md:219:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"For a LUT generated by your own script, ingest it with `--from`; media-use validates it before regis","category":"blocker","line_end":219,"severity":"low","line_start":219},{"id":"blocker:SKILL.md:229:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"Smart grade is `grade --for <media>`. It runs local `ffmpeg`/`ffprobe` signalstats, merges a bounded","category":"blocker","line_end":229,"severity":"low","line_start":229},{"id":"blocker:SKILL.md:264:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"upsell. Cost rule (X4): the agent confirms before an agent-initiated paid call;","category":"blocker","line_end":264,"severity":"low","line_start":264},{"id":"blocker:SKILL.md:265:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"a user-requested one just runs — `heygen.video` is flagged paid (metered free","category":"blocker","line_end":265,"severity":"low","line_start":265},{"id":"blocker:SKILL.md:309:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"id         type   dur   dims       path                          description","category":"blocker","line_end":309,"severity":"low","line_start":309},{"id":"blocker:SKILL.md:450:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"media-use uses the same shared install id as the `hyperframes` CLI/studio","category":"blocker","line_end":450,"severity":"low","line_start":450},{"id":"obfuscation:audio/references/captions/transcript-handling.md:54:unicode-escape-sequence","file":"audio/references/captions/transcript-handling.md","pattern":"Unicode escape sequence","snippet":"if (/^[♪�\\u266a\\u266b\\u266c\\u266d\\u266e\\u266f]+$/.test(w.text)) return false;","category":"obfuscation","line_end":54,"severity":"low","line_start":54},{"id":"obfuscation:scripts/lib/cube-validate.mjs:85:unicode-escape-sequence","file":"scripts/lib/cube-validate.mjs","pattern":"Unicode escape sequence","snippet":".replace(/^\\uFEFF/, \"\")","category":"obfuscation","line_end":85,"severity":"low","line_start":85},{"id":"obfuscation:scripts/lib/logo-provider.test.mjs:75:url-decode","file":"scripts/lib/logo-provider.test.mjs","pattern":"URL decode","snippet":"seen.push(decodeURIComponent(String(url)));","category":"obfuscation","line_end":75,"severity":"low","line_start":75},{"id":"env_access:audio/scripts/lib/bgm.mjs:33:dotenv-library","file":"audio/scripts/lib/bgm.mjs","pattern":"dotenv library","snippet":"const LYRIA_PY_DEPS = [\"google-genai\", \"python-dotenv\"];","category":"env_access","line_end":33,"severity":"low","line_start":33},{"id":"env_access:audio/scripts/lyria-recipe.py:9:dotenv-library","file":"audio/scripts/lyria-recipe.py","pattern":"dotenv library","snippet":"pip install google-genai python-dotenv. audio.mjs Step 4b installs these on","category":"env_access","line_end":9,"severity":"low","line_start":9},{"id":"env_access:audio/scripts/lib/heygen.mjs:38:environment-variable-access-bracket-notation","file":"audio/scripts/lib/heygen.mjs","pattern":"Environment variable access (bracket notation)","snippet":"if (!(key in process.env)) process.env[key] = val;","category":"env_access","line_end":38,"severity":"low","line_start":38},{"id":"env_access:scripts/lib/heygen-video-provider.test.mjs:113:environment-variable-access-bracket-notation","file":"scripts/lib/heygen-video-provider.test.mjs","pattern":"Environment variable access (bracket notation)","snippet":"if (value === undefined) delete process.env[key];","category":"env_access","line_end":113,"severity":"low","line_start":113},{"id":"env_access:scripts/lib/heygen-video-provider.test.mjs:114:environment-variable-access-bracket-notation","file":"scripts/lib/heygen-video-provider.test.mjs","pattern":"Environment variable access (bracket notation)","snippet":"else process.env[key] = value;","category":"env_access","line_end":114,"severity":"low","line_start":114},{"id":"env_access:scripts/lib/misses.test.mjs:17:environment-variable-access-bracket-notation","file":"scripts/lib/misses.test.mjs","pattern":"Environment variable access (bracket notation)","snippet":"for (const k of Object.keys(process.env)) if (!(k in saved)) delete process.env[k];","category":"env_access","line_end":17,"severity":"low","line_start":17},{"id":"env_access:scripts/lib/prefs-store.test.mjs:27:environment-variable-access-bracket-notation","file":"scripts/lib/prefs-store.test.mjs","pattern":"Environment variable access (bracket notation)","snippet":"for (const k of Object.keys(process.env)) if (!(k in saved)) delete process.env[k];","category":"env_access","line_end":27,"severity":"low","line_start":27},{"id":"env_access:scripts/lib/recipe-store.test.mjs:91:environment-variable-access-bracket-notation","file":"scripts/lib/recipe-store.test.mjs","pattern":"Environment variable access (bracket notation)","snippet":"for (const k of Object.keys(process.env)) if (!(k in saved)) delete process.env[k];","category":"env_access","line_end":91,"severity":"low","line_start":91},{"id":"env_access:scripts/lib/stats.test.mjs:19:environment-variable-access-bracket-notation","file":"scripts/lib/stats.test.mjs","pattern":"Environment variable access (bracket notation)","snippet":"for (const k of Object.keys(process.env)) if (!(k in saved)) delete process.env[k];","category":"env_access","line_end":19,"severity":"low","line_start":19},{"id":"env_access:scripts/lib/telemetry.test.mjs:25:environment-variable-access-bracket-notation","file":"scripts/lib/telemetry.test.mjs","pattern":"Environment variable access (bracket notation)","snippet":"for (const k of Object.keys(process.env)) if (!(k in saved)) delete process.env[k];","category":"env_access","line_end":25,"severity":"low","line_start":25},{"id":"env_access:scripts/lib/telemetry.test.mjs:31:environment-variable-access-bracket-notation","file":"scripts/lib/telemetry.test.mjs","pattern":"Environment variable access (bracket notation)","snippet":"delete process.env[k];","category":"env_access","line_end":31,"severity":"low","line_start":31},{"id":"env_access:audio/scripts/audio.mjs:79:environment-variable-access-dot-notation","file":"audio/scripts/audio.mjs","pattern":"Environment variable access (dot notation)","snippet":"const ttsConcurrency = Math.max(1, Number(process.env.HYPERFRAMES_TTS_CONCURRENCY) || 4);","category":"env_access","line_end":79,"severity":"low","line_start":79},{"id":"env_access:audio/scripts/lib/bgm.mjs:21:environment-variable-access-dot-notation","file":"audio/scripts/lib/bgm.mjs","pattern":"Environment variable access (dot notation)","snippet":"const lyriaKey = () => process.env.GEMINI_API_KEY || process.env.GOOGLE_API_KEY || \"\";","category":"env_access","line_end":21,"severity":"low","line_start":21},{"id":"env_access:audio/scripts/lib/heygen.mjs:50:environment-variable-access-dot-notation","file":"audio/scripts/lib/heygen.mjs","pattern":"Environment variable access (dot notation)","snippet":"const envKey = process.env.HEYGEN_API_KEY || process.env.HYPERFRAMES_API_KEY;","category":"env_access","line_end":50,"severity":"low","line_start":50},{"id":"env_access:audio/scripts/lib/heygen.mjs:53:environment-variable-access-dot-notation","file":"audio/scripts/lib/heygen.mjs","pattern":"Environment variable access (dot notation)","snippet":"const file = join(process.env.HEYGEN_CONFIG_DIR || join(homedir(), \".heygen\"), \"credentials\");","category":"env_access","line_end":53,"severity":"low","line_start":53},{"id":"env_access:audio/scripts/lib/heygen.test.mjs:9:environment-variable-access-dot-notation","file":"audio/scripts/lib/heygen.test.mjs","pattern":"Environment variable access (dot notation)","snippet":"const previousApiKey = process.env.HEYGEN_API_KEY;","category":"env_access","line_end":9,"severity":"low","line_start":9},{"id":"env_access:audio/scripts/lib/heygen.test.mjs:10:environment-variable-access-dot-notation","file":"audio/scripts/lib/heygen.test.mjs","pattern":"Environment variable access (dot notation)","snippet":"const previousHyperframesApiKey = process.env.HYPERFRAMES_API_KEY;","category":"env_access","line_end":10,"severity":"low","line_start":10},{"id":"env_access:audio/scripts/lib/heygen.test.mjs:11:environment-variable-access-dot-notation","file":"audio/scripts/lib/heygen.test.mjs","pattern":"Environment variable access (dot notation)","snippet":"const previousConfigDir = process.env.HEYGEN_CONFIG_DIR;","category":"env_access","line_end":11,"severity":"low","line_start":11},{"id":"env_access:audio/scripts/lib/heygen.test.mjs:13:environment-variable-access-dot-notation","file":"audio/scripts/lib/heygen.test.mjs","pattern":"Environment variable access (dot notation)","snippet":"delete process.env.HEYGEN_API_KEY;","category":"env_access","line_end":13,"severity":"low","line_start":13},{"id":"env_access:scripts/lib/bundled-sfx-provider.mjs:5:environment-variable-access-dot-notation","file":"scripts/lib/bundled-sfx-provider.mjs","pattern":"Environment variable access (dot notation)","snippet":"process.env.HYPERFRAMES_MEDIA_USE_SFX_DIR ||","category":"env_access","line_end":5,"severity":"low","line_start":5},{"id":"env_access:scripts/lib/candidates.test.mjs:15:environment-variable-access-dot-notation","file":"scripts/lib/candidates.test.mjs","pattern":"Environment variable access (dot notation)","snippet":"process.env.HOME = home;","category":"env_access","line_end":15,"severity":"low","line_start":15},{"id":"env_access:scripts/lib/codex-provider.mjs:20:environment-variable-access-dot-notation","file":"scripts/lib/codex-provider.mjs","pattern":"Environment variable access (dot notation)","snippet":"return join(process.env.CODEX_HOME || join(homedir(), \".codex\"), \"generated_images\");","category":"env_access","line_end":20,"severity":"low","line_start":20},{"id":"env_access:scripts/lib/codex-provider.mjs:77:environment-variable-access-dot-notation","file":"scripts/lib/codex-provider.mjs","pattern":"Environment variable access (dot notation)","snippet":"const authPath = join(process.env.CODEX_HOME || join(homedir(), \".codex\"), \"auth.json\");","category":"env_access","line_end":77,"severity":"low","line_start":77},{"id":"env_access:scripts/lib/grade-analyzer.mjs:8:environment-variable-access-dot-notation","file":"scripts/lib/grade-analyzer.mjs","pattern":"Environment variable access (dot notation)","snippet":"const SIGNALSTATS_TIMEOUT_MS = Number(process.env.HYPERFRAMES_ANALYZE_TIMEOUT_MS) || 15000;","category":"env_access","line_end":8,"severity":"low","line_start":8},{"id":"env_access:scripts/lib/heygen-cli.test.mjs:203:environment-variable-access-dot-notation","file":"scripts/lib/heygen-cli.test.mjs","pattern":"Environment variable access (dot notation)","snippet":"const previousOptOut = process.env.HYPERFRAMES_NO_TELEMETRY;","category":"env_access","line_end":203,"severity":"low","line_start":203},{"id":"env_access:scripts/lib/heygen-cli.test.mjs:204:environment-variable-access-dot-notation","file":"scripts/lib/heygen-cli.test.mjs","pattern":"Environment variable access (dot notation)","snippet":"process.env.HYPERFRAMES_NO_TELEMETRY = \"1\";","category":"env_access","line_end":204,"severity":"low","line_start":204},{"id":"env_access:scripts/lib/heygen-cli.test.mjs:211:environment-variable-access-dot-notation","file":"scripts/lib/heygen-cli.test.mjs","pattern":"Environment variable access (dot notation)","snippet":"delete process.env.HYPERFRAMES_NO_TELEMETRY;","category":"env_access","line_end":211,"severity":"low","line_start":211},{"id":"env_access:audio/scripts/audio.mjs:79:environment-variable-object","file":"audio/scripts/audio.mjs","pattern":"Environment variable object","snippet":"const ttsConcurrency = Math.max(1, Number(process.env.HYPERFRAMES_TTS_CONCURRENCY) || 4);","category":"env_access","line_end":79,"severity":"low","line_start":79},{"id":"env_access:audio/scripts/lib/bgm.mjs:21:environment-variable-object","file":"audio/scripts/lib/bgm.mjs","pattern":"Environment variable object","snippet":"const lyriaKey = () => process.env.GEMINI_API_KEY || process.env.GOOGLE_API_KEY || \"\";","category":"env_access","line_end":21,"severity":"low","line_start":21},{"id":"env_access:audio/scripts/lib/heygen.mjs:38:environment-variable-object","file":"audio/scripts/lib/heygen.mjs","pattern":"Environment variable object","snippet":"if (!(key in process.env)) process.env[key] = val;","category":"env_access","line_end":38,"severity":"low","line_start":38},{"id":"env_access:audio/scripts/lib/heygen.mjs:50:environment-variable-object","file":"audio/scripts/lib/heygen.mjs","pattern":"Environment variable object","snippet":"const envKey = process.env.HEYGEN_API_KEY || process.env.HYPERFRAMES_API_KEY;","category":"env_access","line_end":50,"severity":"low","line_start":50},{"id":"env_access:audio/scripts/lib/heygen.mjs:53:environment-variable-object","file":"audio/scripts/lib/heygen.mjs","pattern":"Environment variable object","snippet":"const file = join(process.env.HEYGEN_CONFIG_DIR || join(homedir(), \".heygen\"), \"credentials\");","category":"env_access","line_end":53,"severity":"low","line_start":53},{"id":"env_access:audio/scripts/lib/heygen.test.mjs:9:environment-variable-object","file":"audio/scripts/lib/heygen.test.mjs","pattern":"Environment variable object","snippet":"const previousApiKey = process.env.HEYGEN_API_KEY;","category":"env_access","line_end":9,"severity":"low","line_start":9},{"id":"env_access:audio/scripts/lib/heygen.test.mjs:10:environment-variable-object","file":"audio/scripts/lib/heygen.test.mjs","pattern":"Environment variable object","snippet":"const previousHyperframesApiKey = process.env.HYPERFRAMES_API_KEY;","category":"env_access","line_end":10,"severity":"low","line_start":10},{"id":"env_access:audio/scripts/lib/heygen.test.mjs:11:environment-variable-object","file":"audio/scripts/lib/heygen.test.mjs","pattern":"Environment variable object","snippet":"const previousConfigDir = process.env.HEYGEN_CONFIG_DIR;","category":"env_access","line_end":11,"severity":"low","line_start":11},{"id":"env_access:scripts/lib/bundled-sfx-provider.mjs:5:environment-variable-object","file":"scripts/lib/bundled-sfx-provider.mjs","pattern":"Environment variable object","snippet":"process.env.HYPERFRAMES_MEDIA_USE_SFX_DIR ||","category":"env_access","line_end":5,"severity":"low","line_start":5},{"id":"env_access:scripts/lib/candidates.test.mjs:15:environment-variable-object","file":"scripts/lib/candidates.test.mjs","pattern":"Environment variable object","snippet":"process.env.HOME = home;","category":"env_access","line_end":15,"severity":"low","line_start":15},{"id":"env_access:scripts/lib/codex-provider.mjs:20:environment-variable-object","file":"scripts/lib/codex-provider.mjs","pattern":"Environment variable object","snippet":"return join(process.env.CODEX_HOME || join(homedir(), \".codex\"), \"generated_images\");","category":"env_access","line_end":20,"severity":"low","line_start":20},{"id":"env_access:scripts/lib/codex-provider.mjs:77:environment-variable-object","file":"scripts/lib/codex-provider.mjs","pattern":"Environment variable object","snippet":"const authPath = join(process.env.CODEX_HOME || join(homedir(), \".codex\"), \"auth.json\");","category":"env_access","line_end":77,"severity":"low","line_start":77},{"id":"env_access:scripts/lib/grade-analyzer.mjs:8:environment-variable-object","file":"scripts/lib/grade-analyzer.mjs","pattern":"Environment variable object","snippet":"const SIGNALSTATS_TIMEOUT_MS = Number(process.env.HYPERFRAMES_ANALYZE_TIMEOUT_MS) || 15000;","category":"env_access","line_end":8,"severity":"low","line_start":8},{"id":"env_access:scripts/lib/heygen-cli.test.mjs:203:environment-variable-object","file":"scripts/lib/heygen-cli.test.mjs","pattern":"Environment variable object","snippet":"const previousOptOut = process.env.HYPERFRAMES_NO_TELEMETRY;","category":"env_access","line_end":203,"severity":"low","line_start":203},{"id":"env_access:scripts/lib/heygen-cli.test.mjs:204:environment-variable-object","file":"scripts/lib/heygen-cli.test.mjs","pattern":"Environment variable object","snippet":"process.env.HYPERFRAMES_NO_TELEMETRY = \"1\";","category":"env_access","line_end":204,"severity":"low","line_start":204},{"id":"env_access:scripts/lib/heygen-cli.test.mjs:211:environment-variable-object","file":"scripts/lib/heygen-cli.test.mjs","pattern":"Environment variable object","snippet":"delete process.env.HYPERFRAMES_NO_TELEMETRY;","category":"env_access","line_end":211,"severity":"low","line_start":211},{"id":"network:audio/scripts/lib/heygen.mjs:116:fetch-api-call","file":"audio/scripts/lib/heygen.mjs","pattern":"Fetch API call","snippet":"const res = await fetch(`${HEYGEN_BASE}${path}`, opts);","category":"network","line_end":116,"severity":"low","line_start":116},{"id":"network:audio/scripts/lib/heygen.mjs:128:fetch-api-call","file":"audio/scripts/lib/heygen.mjs","pattern":"Fetch API call","snippet":"const res = await fetch(url);","category":"network","line_end":128,"severity":"low","line_start":128},{"id":"network:scripts/lib/freeze.mjs:10:fetch-api-call","file":"scripts/lib/freeze.mjs","pattern":"Fetch API call","snippet":"const res = await fetch(url);","category":"network","line_end":10,"severity":"low","line_start":10},{"id":"network:scripts/lib/logo-provider.mjs:108:fetch-api-call","file":"scripts/lib/logo-provider.mjs","pattern":"Fetch API call","snippet":"const res = await fetch(url, { signal: AbortSignal.timeout(10_000) });","category":"network","line_end":108,"severity":"low","line_start":108},{"id":"network:scripts/lib/logo-provider.mjs:114:fetch-api-call","file":"scripts/lib/logo-provider.mjs","pattern":"Fetch API call","snippet":"const res = await fetch(url, { method: \"HEAD\", signal: AbortSignal.timeout(10_000) });","category":"network","line_end":114,"severity":"low","line_start":114},{"id":"network:scripts/lib/logo-provider.mjs:199:fetch-api-call","file":"scripts/lib/logo-provider.mjs","pattern":"Fetch API call","snippet":"const res = await fetch(url, { signal: AbortSignal.timeout(10_000) });","category":"network","line_end":199,"severity":"low","line_start":199},{"id":"network:scripts/lib/telemetry.mjs:172:fetch-api-call","file":"scripts/lib/telemetry.mjs","pattern":"Fetch API call","snippet":"await fetch(`${posthogHost()}/batch/`, {","category":"network","line_end":172,"severity":"low","line_start":172},{"id":"network:audio/references/captions/transcript-handling.md:70:hardcoded-url","file":"audio/references/captions/transcript-handling.md","pattern":"Hardcoded URL","snippet":"curl https://api.openai.com/v1/audio/transcriptions \\","category":"network","line_end":70,"severity":"low","line_start":70},{"id":"network:audio/references/captions/transcript-handling.md:83:hardcoded-url","file":"audio/references/captions/transcript-handling.md","pattern":"Hardcoded URL","snippet":"curl https://api.groq.com/openai/v1/audio/transcriptions \\","category":"network","line_end":83,"severity":"low","line_start":83},{"id":"network:audio/scripts/lib/heygen.mjs:11:hardcoded-url","file":"audio/scripts/lib/heygen.mjs","pattern":"Hardcoded URL","snippet":"export const HEYGEN_BASE = \"https://api.heygen.com/v3\";","category":"network","line_end":11,"severity":"low","line_start":11},{"id":"network:audio/scripts/lib/tts.test.mjs:117:hardcoded-url","file":"audio/scripts/lib/tts.test.mjs","pattern":"Hardcoded URL","snippet":"heygenJSON: async () => ({ data: { audio_url: \"http://audio.example/x\" } }),","category":"network","line_end":117,"severity":"low","line_start":117},{"id":"network:audio/scripts/lib/tts.test.mjs:141:hardcoded-url","file":"audio/scripts/lib/tts.test.mjs","pattern":"Hardcoded URL","snippet":"heygenJSON: async () => ({ data: { audio_url: \"http://audio.example/x\" } }),","category":"network","line_end":141,"severity":"low","line_start":141},{"id":"network:luts/index.json:9:hardcoded-url","file":"luts/index.json","pattern":"Hardcoded URL","snippet":"\"url\": \"https://static.heygen.ai/luts/teal-orange-blockbuster.cube\",","category":"network","line_end":9,"severity":"low","line_start":9},{"id":"network:luts/index.json:27:hardcoded-url","file":"luts/index.json","pattern":"Hardcoded URL","snippet":"\"url\": \"https://static.heygen.ai/luts/bleach-bypass.cube\",","category":"network","line_end":27,"severity":"low","line_start":27},{"id":"network:luts/index.json:44:hardcoded-url","file":"luts/index.json","pattern":"Hardcoded URL","snippet":"\"url\": \"https://static.heygen.ai/luts/film-fade.cube\",","category":"network","line_end":44,"severity":"low","line_start":44},{"id":"network:references/operations.md:266:hardcoded-url","file":"references/operations.md","pattern":"Hardcoded URL","snippet":"\"image\": { \"type\": \"url\", \"url\": \"https://example.com/person.jpg\" },","category":"network","line_end":266,"severity":"low","line_start":266},{"id":"network:scripts/lib/freeze.test.mjs:6:hardcoded-url","file":"scripts/lib/freeze.test.mjs","pattern":"Hardcoded URL","snippet":"assert.equal(isDirectMediaUrl(\"https://cdn.example.com/clip.mp4\"), true);","category":"network","line_end":6,"severity":"low","line_start":6},{"id":"network:scripts/lib/freeze.test.mjs:7:hardcoded-url","file":"scripts/lib/freeze.test.mjs","pattern":"Hardcoded URL","snippet":"assert.equal(isDirectMediaUrl(\"https://example.com/a/b/track.mp3\"), true);","category":"network","line_end":7,"severity":"low","line_start":7},{"id":"network:scripts/lib/freeze.test.mjs:8:hardcoded-url","file":"scripts/lib/freeze.test.mjs","pattern":"Hardcoded URL","snippet":"assert.equal(isDirectMediaUrl(\"http://example.com/logo.svg\"), true);","category":"network","line_end":8,"severity":"low","line_start":8},{"id":"network:scripts/lib/freeze.test.mjs:12:hardcoded-url","file":"scripts/lib/freeze.test.mjs","pattern":"Hardcoded URL","snippet":"assert.equal(isDirectMediaUrl(\"https://www.youtube.com/watch?v=abc\"), false);","category":"network","line_end":12,"severity":"low","line_start":12},{"id":"network:scripts/lib/freeze.test.mjs:13:hardcoded-url","file":"scripts/lib/freeze.test.mjs","pattern":"Hardcoded URL","snippet":"assert.equal(isDirectMediaUrl(\"https://youtu.be/abc\"), false);","category":"network","line_end":13,"severity":"low","line_start":13},{"id":"network:scripts/lib/freeze.test.mjs:14:hardcoded-url","file":"scripts/lib/freeze.test.mjs","pattern":"Hardcoded URL","snippet":"assert.equal(isDirectMediaUrl(\"https://vimeo.com/12345\"), false);","category":"network","line_end":14,"severity":"low","line_start":14},{"id":"network:scripts/lib/freeze.test.mjs:15:hardcoded-url","file":"scripts/lib/freeze.test.mjs","pattern":"Hardcoded URL","snippet":"assert.equal(isDirectMediaUrl(\"https://x.com/u/status/1\"), false);","category":"network","line_end":15,"severity":"low","line_start":15},{"id":"network:scripts/lib/freeze.test.mjs:19:hardcoded-url","file":"scripts/lib/freeze.test.mjs","pattern":"Hardcoded URL","snippet":"assert.equal(isDirectMediaUrl(\"https://example.com/page\"), false, \"no media extension\");","category":"network","line_end":19,"severity":"low","line_start":19},{"id":"network:SKILL.md:13:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"curl -fsSL https://static.heygen.ai/cli/install.sh | bash","category":"network","line_end":13,"severity":"low","line_start":13},{"id":"network:SKILL.md:415:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"| `heygen`           | catalog (bgm/sfx/image/icon) + TTS (voice) + avatar video — the free-usage pa","category":"network","line_end":415,"severity":"low","line_start":415},{"id":"network:SKILL.md:419:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"| `ltx-2-mlx`        | local video gen                                                              ","category":"network","line_end":419,"severity":"low","line_start":419},{"id":"env_access:audio/scripts/lib/tts.mjs:230:python-environment-access","file":"audio/scripts/lib/tts.mjs","pattern":"Python environment access","snippet":"client = ElevenLabs(api_key=os.environ[\"ELEVENLABS_API_KEY\"])","category":"env_access","line_end":230,"severity":"low","line_start":230},{"id":"env_access:audio/scripts/lyria-recipe.py:50:python-environment-access","file":"audio/scripts/lyria-recipe.py","pattern":"Python environment access","snippet":"api_key = os.environ.get(\"GOOGLE_API_KEY\") or os.environ.get(\"GEMINI_API_KEY\") or \"\"","category":"env_access","line_end":50,"severity":"low","line_start":50},{"id":"filesystem:audio/scripts/audio.test.mjs:3:temp-file-creation","file":"audio/scripts/audio.test.mjs","pattern":"Temp file creation","snippet":"import { mkdtempSync, rmSync, existsSync } from \"node:fs\";","category":"filesystem","line_end":3,"severity":"low","line_start":3},{"id":"filesystem:audio/scripts/audio.test.mjs:18:temp-file-creation","file":"audio/scripts/audio.test.mjs","pattern":"Temp file creation","snippet":"const dir = mkdtempSync(join(tmpdir(), \"mu-audio-\"));","category":"filesystem","line_end":18,"severity":"low","line_start":18},{"id":"filesystem:audio/scripts/audio.test.mjs:36:temp-file-creation","file":"audio/scripts/audio.test.mjs","pattern":"Temp file creation","snippet":"const dir = mkdtempSync(join(tmpdir(), \"mu-audio-\"));","category":"filesystem","line_end":36,"severity":"low","line_start":36},{"id":"filesystem:audio/scripts/lib/heygen.test.mjs:3:temp-file-creation","file":"audio/scripts/lib/heygen.test.mjs","pattern":"Temp file creation","snippet":"import { mkdtempSync, rmSync, writeFileSync } from \"node:fs\";","category":"filesystem","line_end":3,"severity":"low","line_start":3},{"id":"filesystem:audio/scripts/lib/heygen.test.mjs:42:temp-file-creation","file":"audio/scripts/lib/heygen.test.mjs","pattern":"Temp file creation","snippet":"const dir = mkdtempSync(join(tmpdir(), \"heygen-cred-\"));","category":"filesystem","line_end":42,"severity":"low","line_start":42},{"id":"filesystem:audio/scripts/lib/heygen.test.mjs:74:temp-file-creation","file":"audio/scripts/lib/heygen.test.mjs","pattern":"Temp file creation","snippet":"const dir = mkdtempSync(join(tmpdir(), \"heygen-cred-\"));","category":"filesystem","line_end":74,"severity":"low","line_start":74},{"id":"filesystem:audio/scripts/lib/heygen.test.mjs:95:temp-file-creation","file":"audio/scripts/lib/heygen.test.mjs","pattern":"Temp file creation","snippet":"const dir = mkdtempSync(join(tmpdir(), \"heygen-cred-\"));","category":"filesystem","line_end":95,"severity":"low","line_start":95},{"id":"filesystem:audio/scripts/lib/sfx.test.mjs:3:temp-file-creation","file":"audio/scripts/lib/sfx.test.mjs","pattern":"Temp file creation","snippet":"import { mkdtempSync, mkdirSync, writeFileSync, existsSync, rmSync } from \"node:fs\";","category":"filesystem","line_end":3,"severity":"low","line_start":3},{"id":"filesystem:scripts/eval.mjs:9:temp-file-creation","file":"scripts/eval.mjs","pattern":"Temp file creation","snippet":"mkdtempSync,","category":"filesystem","line_end":9,"severity":"low","line_start":9},{"id":"filesystem:scripts/eval.mjs:75:temp-file-creation","file":"scripts/eval.mjs","pattern":"Temp file creation","snippet":"const tmp = mkdtempSync(join(tmpdir(), `mu-eval-${name}-`));","category":"filesystem","line_end":75,"severity":"low","line_start":75},{"id":"filesystem:scripts/lib/adopt.test.mjs:2:temp-file-creation","file":"scripts/lib/adopt.test.mjs","pattern":"Temp file creation","snippet":"import { mkdtempSync, rmSync, mkdirSync, writeFileSync } from \"node:fs\";","category":"filesystem","line_end":2,"severity":"low","line_start":2},{"id":"filesystem:scripts/lib/adopt.test.mjs:9:temp-file-creation","file":"scripts/lib/adopt.test.mjs","pattern":"Temp file creation","snippet":"tmp = mkdtempSync(join(tmpdir(), \"mu-adopt-test-\"));","category":"filesystem","line_end":9,"severity":"low","line_start":9},{"id":"filesystem:scripts/lib/bundled-sfx-provider.test.mjs:2:temp-file-creation","file":"scripts/lib/bundled-sfx-provider.test.mjs","pattern":"Temp file creation","snippet":"import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from \"node:fs\";","category":"filesystem","line_end":2,"severity":"low","line_start":2},{"id":"filesystem:scripts/lib/bundled-sfx-provider.test.mjs:21:temp-file-creation","file":"scripts/lib/bundled-sfx-provider.test.mjs","pattern":"Temp file creation","snippet":"const libraryDir = mkdtempSync(join(tmpdir(), \"media-use-sfx-missing-\"));","category":"filesystem","line_end":21,"severity":"low","line_start":21},{"id":"filesystem:scripts/lib/bundled-sfx-provider.test.mjs:35:temp-file-creation","file":"scripts/lib/bundled-sfx-provider.test.mjs","pattern":"Temp file creation","snippet":"const libraryDir = mkdtempSync(join(tmpdir(), \"media-use-sfx-incomplete-\"));","category":"filesystem","line_end":35,"severity":"low","line_start":35},{"id":"filesystem:scripts/lib/bundled-sfx-provider.test.mjs:51:temp-file-creation","file":"scripts/lib/bundled-sfx-provider.test.mjs","pattern":"Temp file creation","snippet":"const libraryDir = mkdtempSync(join(tmpdir(), \"media-use-sfx-provider-\"));","category":"filesystem","line_end":51,"severity":"low","line_start":51}],"finding_verdicts":[{"id":"blocker:audio/assets/sfx/manifest.json:50:keylogger-keywords","reason":"The matched text describes a bundled sound-effect keystroke. It is media metadata, not input capture or keylogging code.","verdict":"false_positive","confidence":0.82},{"id":"blocker:SKILL.md:13:pipe-to-shell-pattern","reason":"The setup instructions pipe a remote installation script directly into bash without pinning or verification. A compromised or substituted endpoint would execute arbitrary code.","verdict":"confirmed","severity":"critical","confidence":0.99},{"id":"blocker:SKILL.md:415:pipe-to-shell-pattern","reason":"The static pattern lacks evidence of a security-impacting behavior in this media skill.","verdict":"false_positive","confidence":0.82},{"id":"obfuscation:multiple:1:heuristic-dangerous-combination-code-execution-n","reason":"This heuristic combines legitimate media tooling capabilities without showing credential theft, evasion, or unauthorized exfiltration.","verdict":"false_positive","confidence":0.82},{"id":"obfuscation:multiple:1:heuristic-dangerous-combination-network-credenti","reason":"This heuristic combines legitimate media tooling capabilities without showing credential theft, evasion, or unauthorized exfiltration.","verdict":"false_positive","confidence":0.82},{"id":"network:scripts/lib/freeze.test.mjs:34:aws-azure-metadata-endpoint","reason":"This is a negative test case for URL freezing and SSRF protections. It does not make a request to the listed destination.","verdict":"false_positive","confidence":0.9},{"id":"sensitive:audio/scripts/audio.mjs:192:certificate-key-files","reason":"The matched code uses object property names or test environment cleanup. It does not read certificate or private-key files.","verdict":"false_positive","confidence":0.82},{"id":"sensitive:audio/scripts/lib/heygen.mjs:153:certificate-key-files","reason":"The matched code uses object property names or test environment cleanup. It does not read certificate or private-key files.","verdict":"false_positive","confidence":0.82},{"id":"sensitive:audio/scripts/lib/sfx.mjs:107:certificate-key-files","reason":"The matched code uses object property names or test environment cleanup. It does not read certificate or private-key files.","verdict":"false_positive","confidence":0.82},{"id":"sensitive:scripts/lib/bundled-sfx-provider.mjs:91:certificate-key-files","reason":"The matched code uses object property names or test environment cleanup. It does not read certificate or private-key files.","verdict":"false_positive","confidence":0.82},{"id":"sensitive:scripts/lib/bundled-sfx-provider.mjs:101:certificate-key-files","reason":"The matched code uses object property names or test environment cleanup. It does not read certificate or private-key files.","verdict":"false_positive","confidence":0.82},{"id":"sensitive:scripts/lib/bundled-sfx-provider.mjs:104:certificate-key-files","reason":"The matched code uses object property names or test environment cleanup. It does not read certificate or private-key files.","verdict":"false_positive","confidence":0.82},{"id":"sensitive:scripts/lib/misses.test.mjs:17:certificate-key-files","reason":"The matched code uses object property names or test environment cleanup. It does not read certificate or private-key files.","verdict":"false_positive","confidence":0.9},{"id":"sensitive:scripts/lib/prefs-store.test.mjs:27:certificate-key-files","reason":"The matched code uses object property names or test environment cleanup. It does not read certificate or private-key files.","verdict":"false_positive","confidence":0.9},{"id":"sensitive:scripts/lib/probe.test.mjs:26:certificate-key-files","reason":"The matched code uses object property names or test environment cleanup. It does not read certificate or private-key files.","verdict":"false_positive","confidence":0.9},{"id":"sensitive:scripts/lib/recipe-store.test.mjs:91:certificate-key-files","reason":"The matched code uses object property names or test environment cleanup. It does not read certificate or private-key files.","verdict":"false_positive","confidence":0.9},{"id":"sensitive:scripts/lib/registry.mjs:122:certificate-key-files","reason":"The matched code uses object property names or test environment cleanup. It does not read certificate or private-key files.","verdict":"false_positive","confidence":0.82},{"id":"sensitive:scripts/lib/stats.test.mjs:19:certificate-key-files","reason":"The matched code uses object property names or test environment cleanup. It does not read certificate or private-key files.","verdict":"false_positive","confidence":0.9},{"id":"sensitive:audio/references/requirements.md:15:environment-file-access","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"sensitive:audio/references/tts.md:30:environment-file-access","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"sensitive:audio/references/tts.md:41:environment-file-access","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"sensitive:audio/scripts/audio.mjs:79:environment-file-access","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"sensitive:audio/scripts/lib/bgm.mjs:21:environment-file-access","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"sensitive:audio/scripts/lib/heygen.mjs:3:environment-file-access","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"sensitive:audio/scripts/lib/heygen.mjs:19:environment-file-access","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"sensitive:audio/scripts/lib/heygen.mjs:23:environment-file-access","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"sensitive:audio/scripts/lib/heygen.mjs:38:environment-file-access","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"sensitive:scripts/lib/bundled-sfx-provider.mjs:5:environment-file-access","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"sensitive:scripts/lib/candidates.test.mjs:15:environment-file-access","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.9},{"id":"sensitive:scripts/lib/codex-provider.mjs:20:environment-file-access","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"sensitive:scripts/lib/codex-provider.mjs:77:environment-file-access","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"sensitive:scripts/lib/grade-analyzer.mjs:8:environment-file-access","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"sensitive:scripts/lib/heygen-cli.test.mjs:203:environment-file-access","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.9},{"id":"sensitive:scripts/lib/heygen-cli.test.mjs:204:environment-file-access","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.9},{"id":"sensitive:scripts/lib/heygen-cli.test.mjs:211:environment-file-access","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.9},{"id":"sensitive:scripts/lib/heygen-cli.test.mjs:213:environment-file-access","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.9},{"id":"obfuscation:multiple:1:heuristic-suspicious-combination-filesystem-cred","reason":"This heuristic combines legitimate media tooling capabilities without showing credential theft, evasion, or unauthorized exfiltration.","verdict":"false_positive","confidence":0.82},{"id":"obfuscation:scripts/lib/adopt.test.mjs:83:hex-encoded-characters","reason":"The escape sequence is terminal formatting or ordinary parsing in test/support code. It does not conceal executable payloads.","verdict":"false_positive","confidence":0.9},{"id":"obfuscation:scripts/lib/adopt.test.mjs:86:hex-encoded-characters","reason":"The escape sequence is terminal formatting or ordinary parsing in test/support code. It does not conceal executable payloads.","verdict":"false_positive","confidence":0.9},{"id":"obfuscation:scripts/lib/manifest.test.mjs:376:hex-encoded-characters","reason":"The escape sequence is terminal formatting or ordinary parsing in test/support code. It does not conceal executable payloads.","verdict":"false_positive","confidence":0.9},{"id":"obfuscation:scripts/lib/manifest.test.mjs:379:hex-encoded-characters","reason":"The escape sequence is terminal formatting or ordinary parsing in test/support code. It does not conceal executable payloads.","verdict":"false_positive","confidence":0.9},{"id":"obfuscation:scripts/resolve.test.mjs:1018:hex-encoded-characters","reason":"The escape sequence is terminal formatting or ordinary parsing in test/support code. It does not conceal executable payloads.","verdict":"false_positive","confidence":0.9},{"id":"obfuscation:scripts/resolve.test.mjs:1021:hex-encoded-characters","reason":"The escape sequence is terminal formatting or ordinary parsing in test/support code. It does not conceal executable payloads.","verdict":"false_positive","confidence":0.9},{"id":"scripts:audio/scripts/lib/bgm.mjs:232:dynamic-code-evaluation-with-eval","reason":"model.eval() places a machine-learning model in inference mode. It is not JavaScript eval or dynamic evaluation of supplied code.","verdict":"false_positive","confidence":0.82},{"id":"env_access:audio/references/bgm.md:5:generic-api-secret-keys","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"env_access:audio/references/bgm.md:40:generic-api-secret-keys","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"env_access:audio/references/captions/transcript-handling.md:71:generic-api-secret-keys","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"env_access:audio/references/captions/transcript-handling.md:84:generic-api-secret-keys","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"env_access:audio/references/requirements.md:9:generic-api-secret-keys","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"env_access:audio/references/requirements.md:10:generic-api-secret-keys","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"env_access:audio/references/requirements.md:11:generic-api-secret-keys","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"env_access:audio/references/requirements.md:21:generic-api-secret-keys","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"env_access:audio/references/requirements.md:24:generic-api-secret-keys","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"env_access:scripts/lib/telemetry.mjs:19:generic-api-secret-keys","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"env_access:scripts/lib/telemetry.mjs:175:generic-api-secret-keys","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"env_access:scripts/resolve.test.mjs:337:generic-api-secret-keys","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.9},{"id":"env_access:scripts/resolve.test.mjs:343:generic-api-secret-keys","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.9},{"id":"env_access:scripts/resolve.test.mjs:361:generic-api-secret-keys","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:audio/references/bgm.md:5:hidden-file-in-home-directory","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:audio/references/requirements.md:9:hidden-file-in-home-directory","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:audio/references/requirements.md:19:hidden-file-in-home-directory","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:audio/references/requirements.md:21:hidden-file-in-home-directory","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:audio/references/requirements.md:25:hidden-file-in-home-directory","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:audio/references/tts.md:13:hidden-file-in-home-directory","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:audio/references/tts.md:31:hidden-file-in-home-directory","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:audio/scripts/heygen-tts.mjs:16:hidden-file-in-home-directory","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:audio/scripts/lib/heygen.mjs:3:hidden-file-in-home-directory","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:references/operations.md:78:hidden-file-in-home-directory","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:references/telemetry-dashboard.md:8:hidden-file-in-home-directory","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:references/telemetry-dashboard.md:13:hidden-file-in-home-directory","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/lib/cache.mjs:34:hidden-file-in-home-directory","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/lib/candidates.mjs:2:hidden-file-in-home-directory","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/lib/candidates.test.mjs:10:hidden-file-in-home-directory","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/lib/codex-provider.mjs:68:hidden-file-in-home-directory","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/lib/local-models.mjs:63:hidden-file-in-home-directory","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/lib/local-models.mjs:162:hidden-file-in-home-directory","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/lib/local-models.mjs:175:hidden-file-in-home-directory","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/lib/local-models.mjs:188:hidden-file-in-home-directory","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/lib/prefs-store.mjs:11:hidden-file-in-home-directory","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:SKILL.md:37:hidden-file-in-home-directory","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:SKILL.md:138:hidden-file-in-home-directory","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:SKILL.md:283:hidden-file-in-home-directory","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:SKILL.md:285:hidden-file-in-home-directory","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:SKILL.md:318:hidden-file-in-home-directory","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:SKILL.md:324:hidden-file-in-home-directory","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:SKILL.md:336:hidden-file-in-home-directory","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:SKILL.md:348:hidden-file-in-home-directory","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:SKILL.md:363:hidden-file-in-home-directory","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/lib/specs.mjs:22:linux-proc-filesystem-access","reason":"The code reads /proc/meminfo only to assess available RAM for local model selection. It is not system reconnaissance for collection or transmission.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/lib/specs.mjs:41:linux-proc-filesystem-access","reason":"The code reads /proc/meminfo only to assess available RAM for local model selection. It is not system reconnaissance for collection or transmission.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/lib/specs.test.mjs:23:linux-proc-filesystem-access","reason":"The code reads /proc/meminfo only to assess available RAM for local model selection. It is not system reconnaissance for collection or transmission.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:audio/scripts/lib/bgm.mjs:14:node-js-child-process-module","reason":"The command execution supports documented local media tools and CLIs. The static match does not demonstrate untrusted shell interpolation or unauthorized execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:audio/scripts/lib/python.mjs:15:node-js-child-process-module","reason":"The command execution supports documented local media tools and CLIs. The static match does not demonstrate untrusted shell interpolation or unauthorized execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:audio/scripts/lib/tts.mjs:16:node-js-child-process-module","reason":"The command execution supports documented local media tools and CLIs. The static match does not demonstrate untrusted shell interpolation or unauthorized execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:audio/scripts/lib/tts.mjs:168:node-js-child-process-module","reason":"The command execution supports documented local media tools and CLIs. The static match does not demonstrate untrusted shell interpolation or unauthorized execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:audio/scripts/lib/tts.spawn.test.mjs:15:node-js-child-process-module","reason":"This is test scaffolding for expected command behavior. It does not create an untrusted execution path in the published skill.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/eval.mjs:18:node-js-child-process-module","reason":"The command execution supports documented local media tools and CLIs. The static match does not demonstrate untrusted shell interpolation or unauthorized execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:scripts/lib/codex-provider.mjs:1:node-js-child-process-module","reason":"The command execution supports documented local media tools and CLIs. The static match does not demonstrate untrusted shell interpolation or unauthorized execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:scripts/lib/cube-validate.test.mjs:3:node-js-child-process-module","reason":"This is test scaffolding for expected command behavior. It does not create an untrusted execution path in the published skill.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/lib/cutlist.test.mjs:2:node-js-child-process-module","reason":"This is test scaffolding for expected command behavior. It does not create an untrusted execution path in the published skill.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/lib/duck.test.mjs:2:node-js-child-process-module","reason":"This is test scaffolding for expected command behavior. It does not create an untrusted execution path in the published skill.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/lib/grade-analyzer.mjs:1:node-js-child-process-module","reason":"The command execution supports documented local media tools and CLIs. The static match does not demonstrate untrusted shell interpolation or unauthorized execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:scripts/lib/grade-analyzer.test.mjs:2:node-js-child-process-module","reason":"This is test scaffolding for expected command behavior. It does not create an untrusted execution path in the published skill.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/lib/heygen-cli.mjs:1:node-js-child-process-module","reason":"The command execution supports documented local media tools and CLIs. The static match does not demonstrate untrusted shell interpolation or unauthorized execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:scripts/lib/heygen-cli.test.mjs:2:node-js-child-process-module","reason":"This is test scaffolding for expected command behavior. It does not create an untrusted execution path in the published skill.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:audio/references/bgm.md:8:path-traversal-sequence","reason":"The match is a relative documentation link or module import, not attacker-controlled path traversal.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:audio/references/captions/authoring.md:3:path-traversal-sequence","reason":"The match is a relative documentation link or module import, not attacker-controlled path traversal.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:audio/references/captions/authoring.md:16:path-traversal-sequence","reason":"The match is a relative documentation link or module import, not attacker-controlled path traversal.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:audio/references/captions/transcript-handling.md:3:path-traversal-sequence","reason":"The match is a relative documentation link or module import, not attacker-controlled path traversal.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:audio/references/captions/transcript-handling.md:60:path-traversal-sequence","reason":"The match is a relative documentation link or module import, not attacker-controlled path traversal.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:audio/references/captions/transcript-handling.md:96:path-traversal-sequence","reason":"The match is a relative documentation link or module import, not attacker-controlled path traversal.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:audio/references/tts.md:7:path-traversal-sequence","reason":"The match is a relative documentation link or module import, not attacker-controlled path traversal.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:audio/scripts/audio.mjs:10:path-traversal-sequence","reason":"The match is a relative documentation link or module import, not attacker-controlled path traversal.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:audio/scripts/lib/tts.mjs:2:path-traversal-sequence","reason":"The match is a relative documentation link or module import, not attacker-controlled path traversal.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/eval.mjs:344:path-traversal-sequence","reason":"The match is a relative documentation link or module import, not attacker-controlled path traversal.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/lib/heygen-search.test.mjs:6:path-traversal-sequence","reason":"The match is a relative documentation link or module import, not attacker-controlled path traversal.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/lib/npx-sync.mjs:2:path-traversal-sequence","reason":"The match is a relative documentation link or module import, not attacker-controlled path traversal.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/lib/tts-local-provider.mjs:5:path-traversal-sequence","reason":"The match is a relative documentation link or module import, not attacker-controlled path traversal.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/lib/tts-local-provider.mjs:33:path-traversal-sequence","reason":"The match is a relative documentation link or module import, not attacker-controlled path traversal.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/lib/tts-local-provider.test.mjs:9:path-traversal-sequence","reason":"The match is a relative documentation link or module import, not attacker-controlled path traversal.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/resolve.mjs:26:path-traversal-sequence","reason":"The match is a relative documentation link or module import, not attacker-controlled path traversal.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:audio/scripts/lib/tts.mjs:93:process-exec","reason":"The command execution supports documented local media tools and CLIs. The static match does not demonstrate untrusted shell interpolation or unauthorized execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:scripts/lib/local-run.mjs:54:process-exec","reason":"The command execution supports documented local media tools and CLIs. The static match does not demonstrate untrusted shell interpolation or unauthorized execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:scripts/lib/npx-sync.mjs:7:process-exec","reason":"The command execution supports documented local media tools and CLIs. The static match does not demonstrate untrusted shell interpolation or unauthorized execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:scripts/lib/specs.mjs:8:process-exec","reason":"The command execution supports documented local media tools and CLIs. The static match does not demonstrate untrusted shell interpolation or unauthorized execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:scripts/lib/specs.mjs:27:process-exec","reason":"The command execution supports documented local media tools and CLIs. The static match does not demonstrate untrusted shell interpolation or unauthorized execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:scripts/lib/specs.mjs:41:process-exec","reason":"The command execution supports documented local media tools and CLIs. The static match does not demonstrate untrusted shell interpolation or unauthorized execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:scripts/lib/specs.mjs:58:process-exec","reason":"The command execution supports documented local media tools and CLIs. The static match does not demonstrate untrusted shell interpolation or unauthorized execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:audio/scripts/lib/bgm.mjs:148:process-spawn","reason":"The command execution supports documented local media tools and CLIs. The static match does not demonstrate untrusted shell interpolation or unauthorized execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:audio/scripts/lib/bgm.mjs:166:process-spawn","reason":"The command execution supports documented local media tools and CLIs. The static match does not demonstrate untrusted shell interpolation or unauthorized execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:audio/scripts/lib/python.mjs:7:process-spawn","reason":"The command execution supports documented local media tools and CLIs. The static match does not demonstrate untrusted shell interpolation or unauthorized execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:audio/scripts/lib/python.test.mjs:6:process-spawn","reason":"This is test scaffolding for expected command behavior. It does not create an untrusted execution path in the published skill.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:audio/scripts/lib/tts.spawn.test.mjs:12:process-spawn","reason":"This is test scaffolding for expected command behavior. It does not create an untrusted execution path in the published skill.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/resolve.test.mjs:85:process-spawn","reason":"This is test scaffolding for expected command behavior. It does not create an untrusted execution path in the published skill.","verdict":"false_positive","confidence":0.9},{"id":"scripts:audio/scripts/lib/tts.mjs:93:python-exec-function","reason":"The static pattern lacks evidence of a security-impacting behavior in this media skill.","verdict":"false_positive","confidence":0.82},{"id":"scripts:scripts/lib/local-run.mjs:54:python-exec-function","reason":"The static pattern lacks evidence of a security-impacting behavior in this media skill.","verdict":"false_positive","confidence":0.82},{"id":"scripts:scripts/lib/npx-sync.mjs:7:python-exec-function","reason":"The static pattern lacks evidence of a security-impacting behavior in this media skill.","verdict":"false_positive","confidence":0.82},{"id":"scripts:scripts/lib/specs.mjs:8:python-exec-function","reason":"The static pattern lacks evidence of a security-impacting behavior in this media skill.","verdict":"false_positive","confidence":0.82},{"id":"scripts:scripts/lib/specs.mjs:27:python-exec-function","reason":"The static pattern lacks evidence of a security-impacting behavior in this media skill.","verdict":"false_positive","confidence":0.82},{"id":"scripts:scripts/lib/specs.mjs:41:python-exec-function","reason":"The static pattern lacks evidence of a security-impacting behavior in this media skill.","verdict":"false_positive","confidence":0.82},{"id":"scripts:scripts/lib/specs.mjs:58:python-exec-function","reason":"The static pattern lacks evidence of a security-impacting behavior in this media skill.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/lib/codex-provider.mjs:68:symlink-creation","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:scripts/eval.mjs:43:synchronous-file-execution","reason":"The command execution supports documented local media tools and CLIs. The static match does not demonstrate untrusted shell interpolation or unauthorized execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:scripts/lib/codex-provider.mjs:46:synchronous-file-execution","reason":"The command execution supports documented local media tools and CLIs. The static match does not demonstrate untrusted shell interpolation or unauthorized execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:scripts/lib/codex-provider.mjs:63:synchronous-file-execution","reason":"The command execution supports documented local media tools and CLIs. The static match does not demonstrate untrusted shell interpolation or unauthorized execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:scripts/lib/codex-provider.mjs:105:synchronous-file-execution","reason":"The command execution supports documented local media tools and CLIs. The static match does not demonstrate untrusted shell interpolation or unauthorized execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:scripts/lib/cube-validate.test.mjs:101:synchronous-file-execution","reason":"This is test scaffolding for expected command behavior. It does not create an untrusted execution path in the published skill.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/lib/cube-validate.test.mjs:112:synchronous-file-execution","reason":"This is test scaffolding for expected command behavior. It does not create an untrusted execution path in the published skill.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/lib/cutlist.test.mjs:117:synchronous-file-execution","reason":"This is test scaffolding for expected command behavior. It does not create an untrusted execution path in the published skill.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/lib/duck.test.mjs:100:synchronous-file-execution","reason":"This is test scaffolding for expected command behavior. It does not create an untrusted execution path in the published skill.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/lib/grade-analyzer.mjs:40:synchronous-file-execution","reason":"The command execution supports documented local media tools and CLIs. The static match does not demonstrate untrusted shell interpolation or unauthorized execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:scripts/lib/probe.test.mjs:10:synchronous-process-execution","reason":"This is test scaffolding for expected command behavior. It does not create an untrusted execution path in the published skill.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/lib/specs.mjs:15:synchronous-process-execution","reason":"The command execution supports documented local media tools and CLIs. The static match does not demonstrate untrusted shell interpolation or unauthorized execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:audio/scripts/lib/bgm.mjs:38:synchronous-spawn","reason":"The command execution supports documented local media tools and CLIs. The static match does not demonstrate untrusted shell interpolation or unauthorized execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:audio/scripts/lib/bgm.mjs:48:synchronous-spawn","reason":"The command execution supports documented local media tools and CLIs. The static match does not demonstrate untrusted shell interpolation or unauthorized execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:audio/scripts/lib/python.mjs:19:synchronous-spawn","reason":"The command execution supports documented local media tools and CLIs. The static match does not demonstrate untrusted shell interpolation or unauthorized execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:audio/scripts/lib/tts.mjs:30:synchronous-spawn","reason":"The command execution supports documented local media tools and CLIs. The static match does not demonstrate untrusted shell interpolation or unauthorized execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:audio/scripts/lib/tts.mjs:105:synchronous-spawn","reason":"The command execution supports documented local media tools and CLIs. The static match does not demonstrate untrusted shell interpolation or unauthorized execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:audio/scripts/lib/tts.mjs:110:synchronous-spawn","reason":"The command execution supports documented local media tools and CLIs. The static match does not demonstrate untrusted shell interpolation or unauthorized execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:audio/scripts/lib/tts.mjs:217:synchronous-spawn","reason":"The command execution supports documented local media tools and CLIs. The static match does not demonstrate untrusted shell interpolation or unauthorized execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:audio/scripts/lib/tts.test.mjs:41:synchronous-spawn","reason":"This is test scaffolding for expected command behavior. It does not create an untrusted execution path in the published skill.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/lib/grade-analyzer.test.mjs:13:synchronous-spawn","reason":"This is test scaffolding for expected command behavior. It does not create an untrusted execution path in the published skill.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/lib/heygen-cli.test.mjs:250:synchronous-spawn","reason":"This is test scaffolding for expected command behavior. It does not create an untrusted execution path in the published skill.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/resolve.mjs:1093:synchronous-spawn","reason":"The command execution supports documented local media tools and CLIs. The static match does not demonstrate untrusted shell interpolation or unauthorized execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:scripts/resolve.test.mjs:28:synchronous-spawn","reason":"This is test scaffolding for expected command behavior. It does not create an untrusted execution path in the published skill.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/resolve.test.mjs:33:synchronous-spawn","reason":"This is test scaffolding for expected command behavior. It does not create an untrusted execution path in the published skill.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/resolve.test.mjs:74:synchronous-spawn","reason":"This is test scaffolding for expected command behavior. It does not create an untrusted execution path in the published skill.","verdict":"false_positive","confidence":0.9},{"id":"scripts:scripts/lib/coverage.test.mjs:47:dynamic-import-expression","reason":"Dynamic imports occur in tests that load modules under controlled paths. No user-controlled module specifier is shown.","verdict":"false_positive","confidence":0.9},{"id":"scripts:scripts/lib/coverage.test.mjs:53:dynamic-import-expression","reason":"Dynamic imports occur in tests that load modules under controlled paths. No user-controlled module specifier is shown.","verdict":"false_positive","confidence":0.9},{"id":"scripts:scripts/lib/coverage.test.mjs:55:dynamic-import-expression","reason":"Dynamic imports occur in tests that load modules under controlled paths. No user-controlled module specifier is shown.","verdict":"false_positive","confidence":0.9},{"id":"scripts:scripts/lib/coverage.test.mjs:65:dynamic-import-expression","reason":"Dynamic imports occur in tests that load modules under controlled paths. No user-controlled module specifier is shown.","verdict":"false_positive","confidence":0.9},{"id":"scripts:scripts/lib/coverage.test.mjs:71:dynamic-import-expression","reason":"Dynamic imports occur in tests that load modules under controlled paths. No user-controlled module specifier is shown.","verdict":"false_positive","confidence":0.9},{"id":"scripts:scripts/lib/coverage.test.mjs:75:dynamic-import-expression","reason":"Dynamic imports occur in tests that load modules under controlled paths. No user-controlled module specifier is shown.","verdict":"false_positive","confidence":0.9},{"id":"scripts:scripts/lib/coverage.test.mjs:99:dynamic-import-expression","reason":"Dynamic imports occur in tests that load modules under controlled paths. No user-controlled module specifier is shown.","verdict":"false_positive","confidence":0.9},{"id":"scripts:scripts/lib/coverage.test.mjs:106:dynamic-import-expression","reason":"Dynamic imports occur in tests that load modules under controlled paths. No user-controlled module specifier is shown.","verdict":"false_positive","confidence":0.9},{"id":"scripts:scripts/lib/heygen-video-provider.test.mjs:15:dynamic-import-expression","reason":"Dynamic imports occur in tests that load modules under controlled paths. No user-controlled module specifier is shown.","verdict":"false_positive","confidence":0.9},{"id":"network:scripts/lib/freeze.test.mjs:20:ftp-protocol","reason":"This is a negative test case for URL freezing and SSRF protections. It does not make a request to the listed destination.","verdict":"false_positive","confidence":0.9},{"id":"network:scripts/lib/freeze.test.mjs:27:hardcoded-ip-address","reason":"This is a negative test case for URL freezing and SSRF protections. It does not make a request to the listed destination.","verdict":"false_positive","confidence":0.9},{"id":"network:scripts/lib/freeze.test.mjs:28:hardcoded-ip-address","reason":"This is a negative test case for URL freezing and SSRF protections. It does not make a request to the listed destination.","verdict":"false_positive","confidence":0.9},{"id":"network:scripts/lib/freeze.test.mjs:29:hardcoded-ip-address","reason":"This is a negative test case for URL freezing and SSRF protections. It does not make a request to the listed destination.","verdict":"false_positive","confidence":0.9},{"id":"network:scripts/lib/freeze.test.mjs:30:hardcoded-ip-address","reason":"This is a negative test case for URL freezing and SSRF protections. It does not make a request to the listed destination.","verdict":"false_positive","confidence":0.9},{"id":"network:scripts/lib/freeze.test.mjs:31:hardcoded-ip-address","reason":"This is a negative test case for URL freezing and SSRF protections. It does not make a request to the listed destination.","verdict":"false_positive","confidence":0.9},{"id":"network:scripts/lib/freeze.test.mjs:32:hardcoded-ip-address","reason":"This is a negative test case for URL freezing and SSRF protections. It does not make a request to the listed destination.","verdict":"false_positive","confidence":0.9},{"id":"network:scripts/lib/freeze.test.mjs:33:hardcoded-ip-address","reason":"This is a negative test case for URL freezing and SSRF protections. It does not make a request to the listed destination.","verdict":"false_positive","confidence":0.9},{"id":"network:scripts/lib/freeze.test.mjs:34:hardcoded-ip-address","reason":"This is a negative test case for URL freezing and SSRF protections. It does not make a request to the listed destination.","verdict":"false_positive","confidence":0.9},{"id":"network:scripts/lib/freeze.test.mjs:44:hardcoded-ip-address","reason":"This is a negative test case for URL freezing and SSRF protections. It does not make a request to the listed destination.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:audio/references/bgm.md:5:hidden-file-access","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:audio/references/captions/transcript-handling.md:54:hidden-file-access","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:audio/references/requirements.md:9:hidden-file-access","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:audio/references/requirements.md:19:hidden-file-access","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:audio/references/requirements.md:21:hidden-file-access","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:audio/references/requirements.md:25:hidden-file-access","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:audio/references/tts.md:13:hidden-file-access","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:audio/references/tts.md:31:hidden-file-access","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:audio/scripts/audio.test.mjs:45:hidden-file-access","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:references/operations.md:78:hidden-file-access","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:references/telemetry-dashboard.md:8:hidden-file-access","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:references/telemetry-dashboard.md:13:hidden-file-access","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/lib/brand-provider.mjs:27:hidden-file-access","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/lib/cache.mjs:34:hidden-file-access","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/lib/candidates.mjs:2:hidden-file-access","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/lib/candidates.test.mjs:10:hidden-file-access","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/lib/codex-provider.mjs:68:hidden-file-access","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/lib/codex-provider.mjs:81:hidden-file-access","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/lib/codex-provider.mjs:82:hidden-file-access","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/lib/cube-build.mjs:143:hidden-file-access","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/lib/cube-build.mjs:146:hidden-file-access","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:SKILL.md:37:hidden-file-access","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:SKILL.md:138:hidden-file-access","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:SKILL.md:283:hidden-file-access","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:SKILL.md:285:hidden-file-access","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:SKILL.md:318:hidden-file-access","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:SKILL.md:324:hidden-file-access","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:SKILL.md:336:hidden-file-access","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:SKILL.md:348:hidden-file-access","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:SKILL.md:363:hidden-file-access","reason":"The path is a documented application cache, preference, credential, or tool directory. The match alone is not unauthorized hidden-file access.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:audio/references/captions/authoring.md:92:ruby-shell-backtick-execution","reason":"The match is Markdown or JavaScript template-literal syntax used for documented commands, not Ruby backtick execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:audio/references/tts.md:40:ruby-shell-backtick-execution","reason":"The match is Markdown or JavaScript template-literal syntax used for documented commands, not Ruby backtick execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:audio/scripts/audio.mjs:4:ruby-shell-backtick-execution","reason":"The match is Markdown or JavaScript template-literal syntax used for documented commands, not Ruby backtick execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:audio/scripts/audio.mjs:61:ruby-shell-backtick-execution","reason":"The match is Markdown or JavaScript template-literal syntax used for documented commands, not Ruby backtick execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:audio/scripts/audio.mjs:64:ruby-shell-backtick-execution","reason":"The match is Markdown or JavaScript template-literal syntax used for documented commands, not Ruby backtick execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:audio/scripts/audio.mjs:66:ruby-shell-backtick-execution","reason":"The match is Markdown or JavaScript template-literal syntax used for documented commands, not Ruby backtick execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:audio/scripts/audio.mjs:101:ruby-shell-backtick-execution","reason":"The match is Markdown or JavaScript template-literal syntax used for documented commands, not Ruby backtick execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:audio/scripts/audio.mjs:106:ruby-shell-backtick-execution","reason":"The match is Markdown or JavaScript template-literal syntax used for documented commands, not Ruby backtick execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:audio/scripts/audio.mjs:138:ruby-shell-backtick-execution","reason":"The match is Markdown or JavaScript template-literal syntax used for documented commands, not Ruby backtick execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:luts/index.json:2:ruby-shell-backtick-execution","reason":"The match is Markdown or JavaScript template-literal syntax used for documented commands, not Ruby backtick execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:scripts/audio-duck.mjs:28:ruby-shell-backtick-execution","reason":"The match is Markdown or JavaScript template-literal syntax used for documented commands, not Ruby backtick execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:scripts/audio-duck.mjs:54:ruby-shell-backtick-execution","reason":"The match is Markdown or JavaScript template-literal syntax used for documented commands, not Ruby backtick execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:scripts/audio-duck.mjs:90:ruby-shell-backtick-execution","reason":"The match is Markdown or JavaScript template-literal syntax used for documented commands, not Ruby backtick execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:scripts/audio-duck.mjs:94:ruby-shell-backtick-execution","reason":"The match is Markdown or JavaScript template-literal syntax used for documented commands, not Ruby backtick execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:scripts/audio-duck.mjs:107:ruby-shell-backtick-execution","reason":"The match is Markdown or JavaScript template-literal syntax used for documented commands, not Ruby backtick execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:scripts/eval.mjs:61:ruby-shell-backtick-execution","reason":"The match is Markdown or JavaScript template-literal syntax used for documented commands, not Ruby backtick execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:scripts/eval.mjs:75:ruby-shell-backtick-execution","reason":"The match is Markdown or JavaScript template-literal syntax used for documented commands, not Ruby backtick execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:scripts/eval.mjs:203:ruby-shell-backtick-execution","reason":"The match is Markdown or JavaScript template-literal syntax used for documented commands, not Ruby backtick execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:scripts/eval.mjs:220:ruby-shell-backtick-execution","reason":"The match is Markdown or JavaScript template-literal syntax used for documented commands, not Ruby backtick execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:SKILL.md:3:ruby-shell-backtick-execution","reason":"The match is Markdown or JavaScript template-literal syntax used for documented commands, not Ruby backtick execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:SKILL.md:12:ruby-shell-backtick-execution","reason":"The match is Markdown or JavaScript template-literal syntax used for documented commands, not Ruby backtick execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","reason":"The match is Markdown or JavaScript template-literal syntax used for documented commands, not Ruby backtick execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","reason":"The match is Markdown or JavaScript template-literal syntax used for documented commands, not Ruby backtick execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","reason":"The match is Markdown or JavaScript template-literal syntax used for documented commands, not Ruby backtick execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","reason":"The match is Markdown or JavaScript template-literal syntax used for documented commands, not Ruby backtick execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"The match is Markdown or JavaScript template-literal syntax used for documented commands, not Ruby backtick execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"The match is Markdown or JavaScript template-literal syntax used for documented commands, not Ruby backtick execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"The match is Markdown or JavaScript template-literal syntax used for documented commands, not Ruby backtick execution.","verdict":"false_positive","confidence":0.82},{"id":"scripts:scripts/lib/manifest.mjs:124:sharedarraybuffer-spectre-risk","reason":"SharedArrayBuffer is used as a platform capability reference and does not expose a cross-origin browser context here.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:scripts/lib/codex-provider.mjs:68:shell-command-substitution","reason":"The text is an instructional error message describing how to create a PATH symlink. It is not executed by the skill.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:audio/scripts/audio.mjs:42:synchronous-file-operations","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:audio/scripts/audio.mjs:104:synchronous-file-operations","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:audio/scripts/audio.mjs:118:synchronous-file-operations","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:audio/scripts/audio.mjs:282:synchronous-file-operations","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:audio/scripts/heygen-tts.mjs:18:synchronous-file-operations","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:audio/scripts/heygen-tts.mjs:89:synchronous-file-operations","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:audio/scripts/heygen-tts.mjs:112:synchronous-file-operations","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:audio/scripts/lib/heygen.mjs:7:synchronous-file-operations","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:audio/scripts/lib/heygen.mjs:25:synchronous-file-operations","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/audio-duck.mjs:3:synchronous-file-operations","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/audio-duck.mjs:60:synchronous-file-operations","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/audio-duck.mjs:104:synchronous-file-operations","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/eval.mjs:12:synchronous-file-operations","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/eval.mjs:15:synchronous-file-operations","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/eval.mjs:87:synchronous-file-operations","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/eval.mjs:116:synchronous-file-operations","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/eval.mjs:122:synchronous-file-operations","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/eval.mjs:368:synchronous-file-operations","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:audio/scripts/lib/tts.test.mjs:99:temp-directory-access","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:audio/scripts/lib/tts.test.mjs:114:temp-directory-access","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:audio/scripts/lib/tts.test.mjs:127:temp-directory-access","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:audio/scripts/lib/tts.test.mjs:154:temp-directory-access","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/lib/grade-analyzer.test.mjs:144:temp-directory-access","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/lib/local-run.test.mjs:21:temp-directory-access","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/lib/local-run.test.mjs:36:temp-directory-access","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/lib/local-run.test.mjs:39:temp-directory-access","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/lib/codex-provider.mjs:65:template-literal-with-command-substitution","reason":"The text is an instructional error message describing how to create a PATH symlink. It is not executed by the skill.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:audio/scripts/lib/tts.test.mjs:49:unix-shell-invocation","reason":"The shell-related text is in tests for command resolution. It does not demonstrate a production shell injection path.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/lib/heygen-search.test.mjs:19:unix-shell-invocation","reason":"The shell-related text is in tests for command resolution. It does not demonstrate a production shell injection path.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/lib/heygen-video-provider.test.mjs:74:unix-shell-invocation","reason":"The shell-related text is in tests for command resolution. It does not demonstrate a production shell injection path.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/lib/voice-provider.test.mjs:17:unix-shell-invocation","reason":"The shell-related text is in tests for command resolution. It does not demonstrate a production shell injection path.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/resolve.test.mjs:197:unix-shell-invocation","reason":"The shell-related text is in tests for command resolution. It does not demonstrate a production shell injection path.","verdict":"false_positive","confidence":0.9},{"id":"blocker:audio/scripts/lib/tts.mjs:73:network-reconnaissance","reason":"The match is feature-related media/tool discovery or documentation, not collection of system or network intelligence for misuse.","verdict":"false_positive","confidence":0.82},{"id":"blocker:scripts/lib/duck.mjs:19:network-reconnaissance","reason":"The match is feature-related media/tool discovery or documentation, not collection of system or network intelligence for misuse.","verdict":"false_positive","confidence":0.82},{"id":"blocker:scripts/lib/prefs-store.mjs:162:network-reconnaissance","reason":"The match is feature-related media/tool discovery or documentation, not collection of system or network intelligence for misuse.","verdict":"false_positive","confidence":0.82},{"id":"blocker:scripts/lib/prefs-store.test.mjs:166:network-reconnaissance","reason":"The match is feature-related media/tool discovery or documentation, not collection of system or network intelligence for misuse.","verdict":"false_positive","confidence":0.9},{"id":"blocker:scripts/lib/registry.mjs:59:network-reconnaissance","reason":"The match is feature-related media/tool discovery or documentation, not collection of system or network intelligence for misuse.","verdict":"false_positive","confidence":0.82},{"id":"blocker:scripts/transcript-cut.mjs:83:network-reconnaissance","reason":"The match is feature-related media/tool discovery or documentation, not collection of system or network intelligence for misuse.","verdict":"false_positive","confidence":0.82},{"id":"blocker:audio/references/remove-background.md:93:system-reconnaissance","reason":"The match is feature-related media/tool discovery or documentation, not collection of system or network intelligence for misuse.","verdict":"false_positive","confidence":0.82},{"id":"blocker:audio/references/tts.md:35:system-reconnaissance","reason":"The match is feature-related media/tool discovery or documentation, not collection of system or network intelligence for misuse.","verdict":"false_positive","confidence":0.82},{"id":"blocker:audio/references/tts.md:51:system-reconnaissance","reason":"The match is feature-related media/tool discovery or documentation, not collection of system or network intelligence for misuse.","verdict":"false_positive","confidence":0.82},{"id":"blocker:audio/references/tts.md:108:system-reconnaissance","reason":"The match is feature-related media/tool discovery or documentation, not collection of system or network intelligence for misuse.","verdict":"false_positive","confidence":0.82},{"id":"blocker:audio/scripts/audio.mjs:20:system-reconnaissance","reason":"The match is feature-related media/tool discovery or documentation, not collection of system or network intelligence for misuse.","verdict":"false_positive","confidence":0.82},{"id":"blocker:audio/scripts/audio.mjs:124:system-reconnaissance","reason":"The match is feature-related media/tool discovery or documentation, not collection of system or network intelligence for misuse.","verdict":"false_positive","confidence":0.82},{"id":"blocker:audio/scripts/audio.mjs:140:system-reconnaissance","reason":"The match is feature-related media/tool discovery or documentation, not collection of system or network intelligence for misuse.","verdict":"false_positive","confidence":0.82},{"id":"blocker:audio/scripts/audio.mjs:183:system-reconnaissance","reason":"The match is feature-related media/tool discovery or documentation, not collection of system or network intelligence for misuse.","verdict":"false_positive","confidence":0.82},{"id":"blocker:audio/scripts/audio.mjs:244:system-reconnaissance","reason":"The match is feature-related media/tool discovery or documentation, not collection of system or network intelligence for misuse.","verdict":"false_positive","confidence":0.82},{"id":"blocker:references/telemetry-dashboard.md:13:system-reconnaissance","reason":"The match is feature-related media/tool discovery or documentation, not collection of system or network intelligence for misuse.","verdict":"false_positive","confidence":0.82},{"id":"blocker:scripts/audio-duck.mjs:42:system-reconnaissance","reason":"The match is feature-related media/tool discovery or documentation, not collection of system or network intelligence for misuse.","verdict":"false_positive","confidence":0.82},{"id":"blocker:scripts/audio-duck.mjs:103:system-reconnaissance","reason":"The match is feature-related media/tool discovery or documentation, not collection of system or network intelligence for misuse.","verdict":"false_positive","confidence":0.82},{"id":"blocker:scripts/eval.mjs:285:system-reconnaissance","reason":"The match is feature-related media/tool discovery or documentation, not collection of system or network intelligence for misuse.","verdict":"false_positive","confidence":0.82},{"id":"blocker:scripts/eval.mjs:289:system-reconnaissance","reason":"The match is feature-related media/tool discovery or documentation, not collection of system or network intelligence for misuse.","verdict":"false_positive","confidence":0.82},{"id":"blocker:scripts/eval.mjs:290:system-reconnaissance","reason":"The match is feature-related media/tool discovery or documentation, not collection of system or network intelligence for misuse.","verdict":"false_positive","confidence":0.82},{"id":"blocker:scripts/eval.mjs:295:system-reconnaissance","reason":"The match is feature-related media/tool discovery or documentation, not collection of system or network intelligence for misuse.","verdict":"false_positive","confidence":0.82},{"id":"blocker:scripts/eval.mjs:298:system-reconnaissance","reason":"The match is feature-related media/tool discovery or documentation, not collection of system or network intelligence for misuse.","verdict":"false_positive","confidence":0.82},{"id":"blocker:scripts/eval.mjs:300:system-reconnaissance","reason":"The match is feature-related media/tool discovery or documentation, not collection of system or network intelligence for misuse.","verdict":"false_positive","confidence":0.82},{"id":"blocker:scripts/eval.mjs:302:system-reconnaissance","reason":"The match is feature-related media/tool discovery or documentation, not collection of system or network intelligence for misuse.","verdict":"false_positive","confidence":0.82},{"id":"blocker:SKILL.md:219:system-reconnaissance","reason":"The match is feature-related media/tool discovery or documentation, not collection of system or network intelligence for misuse.","verdict":"false_positive","confidence":0.82},{"id":"blocker:SKILL.md:229:system-reconnaissance","reason":"The match is feature-related media/tool discovery or documentation, not collection of system or network intelligence for misuse.","verdict":"false_positive","confidence":0.82},{"id":"blocker:SKILL.md:264:system-reconnaissance","reason":"The match is feature-related media/tool discovery or documentation, not collection of system or network intelligence for misuse.","verdict":"false_positive","confidence":0.82},{"id":"blocker:SKILL.md:265:system-reconnaissance","reason":"The match is feature-related media/tool discovery or documentation, not collection of system or network intelligence for misuse.","verdict":"false_positive","confidence":0.82},{"id":"blocker:SKILL.md:309:system-reconnaissance","reason":"The match is feature-related media/tool discovery or documentation, not collection of system or network intelligence for misuse.","verdict":"false_positive","confidence":0.82},{"id":"blocker:SKILL.md:450:system-reconnaissance","reason":"The match is feature-related media/tool discovery or documentation, not collection of system or network intelligence for misuse.","verdict":"false_positive","confidence":0.82},{"id":"obfuscation:audio/references/captions/transcript-handling.md:54:unicode-escape-sequence","reason":"The escape sequence is terminal formatting or ordinary parsing in test/support code. It does not conceal executable payloads.","verdict":"false_positive","confidence":0.82},{"id":"obfuscation:scripts/lib/cube-validate.mjs:85:unicode-escape-sequence","reason":"The escape sequence is terminal formatting or ordinary parsing in test/support code. It does not conceal executable payloads.","verdict":"false_positive","confidence":0.82},{"id":"obfuscation:scripts/lib/logo-provider.test.mjs:75:url-decode","reason":"The escape sequence is terminal formatting or ordinary parsing in test/support code. It does not conceal executable payloads.","verdict":"false_positive","confidence":0.9},{"id":"env_access:audio/scripts/lib/bgm.mjs:33:dotenv-library","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"env_access:audio/scripts/lyria-recipe.py:9:dotenv-library","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"env_access:audio/scripts/lib/heygen.mjs:38:environment-variable-access-bracket-notation","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"env_access:scripts/lib/heygen-video-provider.test.mjs:113:environment-variable-access-bracket-notation","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.9},{"id":"env_access:scripts/lib/heygen-video-provider.test.mjs:114:environment-variable-access-bracket-notation","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.9},{"id":"env_access:scripts/lib/misses.test.mjs:17:environment-variable-access-bracket-notation","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.9},{"id":"env_access:scripts/lib/prefs-store.test.mjs:27:environment-variable-access-bracket-notation","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.9},{"id":"env_access:scripts/lib/recipe-store.test.mjs:91:environment-variable-access-bracket-notation","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.9},{"id":"env_access:scripts/lib/stats.test.mjs:19:environment-variable-access-bracket-notation","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.9},{"id":"env_access:scripts/lib/telemetry.test.mjs:25:environment-variable-access-bracket-notation","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.9},{"id":"env_access:scripts/lib/telemetry.test.mjs:31:environment-variable-access-bracket-notation","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.9},{"id":"env_access:audio/scripts/audio.mjs:79:environment-variable-access-dot-notation","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"env_access:audio/scripts/lib/bgm.mjs:21:environment-variable-access-dot-notation","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"env_access:audio/scripts/lib/heygen.mjs:50:environment-variable-access-dot-notation","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"env_access:audio/scripts/lib/heygen.mjs:53:environment-variable-access-dot-notation","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"env_access:audio/scripts/lib/heygen.test.mjs:9:environment-variable-access-dot-notation","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.9},{"id":"env_access:audio/scripts/lib/heygen.test.mjs:10:environment-variable-access-dot-notation","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.9},{"id":"env_access:audio/scripts/lib/heygen.test.mjs:11:environment-variable-access-dot-notation","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.9},{"id":"env_access:audio/scripts/lib/heygen.test.mjs:13:environment-variable-access-dot-notation","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.9},{"id":"env_access:scripts/lib/bundled-sfx-provider.mjs:5:environment-variable-access-dot-notation","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"env_access:scripts/lib/candidates.test.mjs:15:environment-variable-access-dot-notation","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.9},{"id":"env_access:scripts/lib/codex-provider.mjs:20:environment-variable-access-dot-notation","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"env_access:scripts/lib/codex-provider.mjs:77:environment-variable-access-dot-notation","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"env_access:scripts/lib/grade-analyzer.mjs:8:environment-variable-access-dot-notation","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"env_access:scripts/lib/heygen-cli.test.mjs:203:environment-variable-access-dot-notation","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.9},{"id":"env_access:scripts/lib/heygen-cli.test.mjs:204:environment-variable-access-dot-notation","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.9},{"id":"env_access:scripts/lib/heygen-cli.test.mjs:211:environment-variable-access-dot-notation","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.9},{"id":"env_access:audio/scripts/audio.mjs:79:environment-variable-object","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"env_access:audio/scripts/lib/bgm.mjs:21:environment-variable-object","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"env_access:audio/scripts/lib/heygen.mjs:38:environment-variable-object","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"env_access:audio/scripts/lib/heygen.mjs:50:environment-variable-object","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"env_access:audio/scripts/lib/heygen.mjs:53:environment-variable-object","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"env_access:audio/scripts/lib/heygen.test.mjs:9:environment-variable-object","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.9},{"id":"env_access:audio/scripts/lib/heygen.test.mjs:10:environment-variable-object","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.9},{"id":"env_access:audio/scripts/lib/heygen.test.mjs:11:environment-variable-object","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.9},{"id":"env_access:scripts/lib/bundled-sfx-provider.mjs:5:environment-variable-object","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"env_access:scripts/lib/candidates.test.mjs:15:environment-variable-object","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.9},{"id":"env_access:scripts/lib/codex-provider.mjs:20:environment-variable-object","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"env_access:scripts/lib/codex-provider.mjs:77:environment-variable-object","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"env_access:scripts/lib/grade-analyzer.mjs:8:environment-variable-object","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"env_access:scripts/lib/heygen-cli.test.mjs:203:environment-variable-object","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.9},{"id":"env_access:scripts/lib/heygen-cli.test.mjs:204:environment-variable-object","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.9},{"id":"env_access:scripts/lib/heygen-cli.test.mjs:211:environment-variable-object","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.9},{"id":"network:audio/scripts/lib/heygen.mjs:116:fetch-api-call","reason":"The network call or URL belongs to a documented media provider, catalog, or telemetry endpoint. No unauthorized destination or secret exfiltration is evidenced.","verdict":"false_positive","confidence":0.82},{"id":"network:audio/scripts/lib/heygen.mjs:128:fetch-api-call","reason":"The network call or URL belongs to a documented media provider, catalog, or telemetry endpoint. No unauthorized destination or secret exfiltration is evidenced.","verdict":"false_positive","confidence":0.82},{"id":"network:scripts/lib/freeze.mjs:10:fetch-api-call","reason":"The network call or URL belongs to a documented media provider, catalog, or telemetry endpoint. No unauthorized destination or secret exfiltration is evidenced.","verdict":"false_positive","confidence":0.82},{"id":"network:scripts/lib/logo-provider.mjs:108:fetch-api-call","reason":"The network call or URL belongs to a documented media provider, catalog, or telemetry endpoint. No unauthorized destination or secret exfiltration is evidenced.","verdict":"false_positive","confidence":0.82},{"id":"network:scripts/lib/logo-provider.mjs:114:fetch-api-call","reason":"The network call or URL belongs to a documented media provider, catalog, or telemetry endpoint. No unauthorized destination or secret exfiltration is evidenced.","verdict":"false_positive","confidence":0.82},{"id":"network:scripts/lib/logo-provider.mjs:199:fetch-api-call","reason":"The network call or URL belongs to a documented media provider, catalog, or telemetry endpoint. No unauthorized destination or secret exfiltration is evidenced.","verdict":"false_positive","confidence":0.82},{"id":"network:scripts/lib/telemetry.mjs:172:fetch-api-call","reason":"The network call or URL belongs to a documented media provider, catalog, or telemetry endpoint. No unauthorized destination or secret exfiltration is evidenced.","verdict":"false_positive","confidence":0.82},{"id":"network:audio/references/captions/transcript-handling.md:70:hardcoded-url","reason":"The network call or URL belongs to a documented media provider, catalog, or telemetry endpoint. No unauthorized destination or secret exfiltration is evidenced.","verdict":"false_positive","confidence":0.82},{"id":"network:audio/references/captions/transcript-handling.md:83:hardcoded-url","reason":"The network call or URL belongs to a documented media provider, catalog, or telemetry endpoint. No unauthorized destination or secret exfiltration is evidenced.","verdict":"false_positive","confidence":0.82},{"id":"network:audio/scripts/lib/heygen.mjs:11:hardcoded-url","reason":"The network call or URL belongs to a documented media provider, catalog, or telemetry endpoint. No unauthorized destination or secret exfiltration is evidenced.","verdict":"false_positive","confidence":0.82},{"id":"network:audio/scripts/lib/tts.test.mjs:117:hardcoded-url","reason":"The network call or URL belongs to a documented media provider, catalog, or telemetry endpoint. No unauthorized destination or secret exfiltration is evidenced.","verdict":"false_positive","confidence":0.9},{"id":"network:audio/scripts/lib/tts.test.mjs:141:hardcoded-url","reason":"The network call or URL belongs to a documented media provider, catalog, or telemetry endpoint. No unauthorized destination or secret exfiltration is evidenced.","verdict":"false_positive","confidence":0.9},{"id":"network:luts/index.json:9:hardcoded-url","reason":"The network call or URL belongs to a documented media provider, catalog, or telemetry endpoint. No unauthorized destination or secret exfiltration is evidenced.","verdict":"false_positive","confidence":0.82},{"id":"network:luts/index.json:27:hardcoded-url","reason":"The network call or URL belongs to a documented media provider, catalog, or telemetry endpoint. No unauthorized destination or secret exfiltration is evidenced.","verdict":"false_positive","confidence":0.82},{"id":"network:luts/index.json:44:hardcoded-url","reason":"The network call or URL belongs to a documented media provider, catalog, or telemetry endpoint. No unauthorized destination or secret exfiltration is evidenced.","verdict":"false_positive","confidence":0.82},{"id":"network:references/operations.md:266:hardcoded-url","reason":"The network call or URL belongs to a documented media provider, catalog, or telemetry endpoint. No unauthorized destination or secret exfiltration is evidenced.","verdict":"false_positive","confidence":0.82},{"id":"network:scripts/lib/freeze.test.mjs:6:hardcoded-url","reason":"The network call or URL belongs to a documented media provider, catalog, or telemetry endpoint. No unauthorized destination or secret exfiltration is evidenced.","verdict":"false_positive","confidence":0.9},{"id":"network:scripts/lib/freeze.test.mjs:7:hardcoded-url","reason":"The network call or URL belongs to a documented media provider, catalog, or telemetry endpoint. No unauthorized destination or secret exfiltration is evidenced.","verdict":"false_positive","confidence":0.9},{"id":"network:scripts/lib/freeze.test.mjs:8:hardcoded-url","reason":"The network call or URL belongs to a documented media provider, catalog, or telemetry endpoint. No unauthorized destination or secret exfiltration is evidenced.","verdict":"false_positive","confidence":0.9},{"id":"network:scripts/lib/freeze.test.mjs:12:hardcoded-url","reason":"The network call or URL belongs to a documented media provider, catalog, or telemetry endpoint. No unauthorized destination or secret exfiltration is evidenced.","verdict":"false_positive","confidence":0.9},{"id":"network:scripts/lib/freeze.test.mjs:13:hardcoded-url","reason":"The network call or URL belongs to a documented media provider, catalog, or telemetry endpoint. No unauthorized destination or secret exfiltration is evidenced.","verdict":"false_positive","confidence":0.9},{"id":"network:scripts/lib/freeze.test.mjs:14:hardcoded-url","reason":"The network call or URL belongs to a documented media provider, catalog, or telemetry endpoint. No unauthorized destination or secret exfiltration is evidenced.","verdict":"false_positive","confidence":0.9},{"id":"network:scripts/lib/freeze.test.mjs:15:hardcoded-url","reason":"The network call or URL belongs to a documented media provider, catalog, or telemetry endpoint. No unauthorized destination or secret exfiltration is evidenced.","verdict":"false_positive","confidence":0.9},{"id":"network:scripts/lib/freeze.test.mjs:19:hardcoded-url","reason":"The network call or URL belongs to a documented media provider, catalog, or telemetry endpoint. No unauthorized destination or secret exfiltration is evidenced.","verdict":"false_positive","confidence":0.9},{"id":"network:SKILL.md:13:hardcoded-url","reason":"The network call or URL belongs to a documented media provider, catalog, or telemetry endpoint. No unauthorized destination or secret exfiltration is evidenced.","verdict":"false_positive","confidence":0.82},{"id":"network:SKILL.md:415:hardcoded-url","reason":"The network call or URL belongs to a documented media provider, catalog, or telemetry endpoint. No unauthorized destination or secret exfiltration is evidenced.","verdict":"false_positive","confidence":0.82},{"id":"network:SKILL.md:419:hardcoded-url","reason":"The network call or URL belongs to a documented media provider, catalog, or telemetry endpoint. No unauthorized destination or secret exfiltration is evidenced.","verdict":"false_positive","confidence":0.82},{"id":"env_access:audio/scripts/lib/tts.mjs:230:python-environment-access","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"env_access:audio/scripts/lyria-recipe.py:50:python-environment-access","reason":"This accesses documented provider configuration or test settings for media services. No evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:audio/scripts/audio.test.mjs:3:temp-file-creation","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:audio/scripts/audio.test.mjs:18:temp-file-creation","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:audio/scripts/audio.test.mjs:36:temp-file-creation","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:audio/scripts/lib/heygen.test.mjs:3:temp-file-creation","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:audio/scripts/lib/heygen.test.mjs:42:temp-file-creation","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:audio/scripts/lib/heygen.test.mjs:74:temp-file-creation","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:audio/scripts/lib/heygen.test.mjs:95:temp-file-creation","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:audio/scripts/lib/sfx.test.mjs:3:temp-file-creation","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/eval.mjs:9:temp-file-creation","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/eval.mjs:75:temp-file-creation","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:scripts/lib/adopt.test.mjs:2:temp-file-creation","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/lib/adopt.test.mjs:9:temp-file-creation","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/lib/bundled-sfx-provider.test.mjs:2:temp-file-creation","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/lib/bundled-sfx-provider.test.mjs:21:temp-file-creation","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/lib/bundled-sfx-provider.test.mjs:35:temp-file-creation","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/lib/bundled-sfx-provider.test.mjs:51:temp-file-creation","reason":"This is local media or test file handling. The static match provides no evidence of unauthorized file access or persistence.","verdict":"false_positive","confidence":0.9}],"semantic_findings":[],"subject_marketplace_commit_sha":"77d0e66fbadeb1f5d1e6a5aada7861240b8ed2d7","subject_content_hash":"a66f5113dd5b2d53fc463b06c238a2bbd33ac8e6c1158f17ef849bb5117024ac","subject_tree_hash":"27757fb40489dd9c4d90ea01faec83c89cc2e9b798bd24e664382e0b921854c4","subject_plugin_path":"skills/heygen-com/media-use","audit_payload_hash":"bec144fa706d478e383f29d3fae15ce2","confirmed_risk_level":"critical","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"77d0e66fbadeb1f5d1e6a5aada7861240b8ed2d7","contentHash":"a66f5113dd5b2d53fc463b06c238a2bbd33ac8e6c1158f17ef849bb5117024ac","treeHash":"27757fb40489dd9c4d90ea01faec83c89cc2e9b798bd24e664382e0b921854c4","pluginPath":"skills/heygen-com/media-use","auditPayloadHash":"bec144fa706d478e383f29d3fae15ce2"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/heygen-com-media-use/audits/6/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"critical","confirmedFindingCount":1,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"blocked","manualInstallPolicy":"allowed_with_warning","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}