{"data":{"skill":{"slug":"heygen-com-remotion-to-hyperframes","name":"remotion-to-hyperframes","icon":"📦","repo":"https://github.com/heygen-com/hyperframes/tree/main/skills/remotion-to-hyperframes/","status":"approved","author":"heygen-com","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"130abd89-c413-4a3a-b093-43e0ac52efb5","skill_id":"238a1a51-c9aa-4f90-acd3-0ef5e0894038","version":2,"content_hash":"af72f6d4a9335b76016bc154d924da6b","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"The static scan produced many hits, but most markdown backtick, path traversal, weak crypto, and Windows SAM alerts are false positives from documentation, expected JSON text, and variable names. Real risk remains because the skill ships shell and Python validation harnesses that run npm, npx, node, ffmpeg, ffprobe, and subprocess commands. I found no evidence of credential exfiltration, prompt injection, or confirmed malicious intent, so this is not a critical block.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"assets/test-corpus/run.sh","line_end":135,"line_start":128},{"file":"scripts/frame_strip.sh","line_end":105,"line_start":52},{"file":"scripts/render_diff.sh","line_end":64,"line_start":56}]},{"factor":"scripts","evidence":[{"file":"scripts/lint_source.py","line_end":354,"line_start":302},{"file":"assets/test-corpus/tier-4-escape-hatch/validate.sh","line_end":45,"line_start":29}]},{"factor":"filesystem","evidence":[{"file":"assets/test-corpus/run.sh","line_end":41,"line_start":40},{"file":"scripts/render_diff.sh","line_end":51,"line_start":49},{"file":"assets/test-corpus/tier-2-multi-scene/setup.sh","line_end":31,"line_start":19}]},{"factor":"network","evidence":[{"file":"assets/test-corpus/tier-3-data-driven/hf-src/index.html","line_end":6,"line_start":6},{"file":"assets/test-corpus/tier-4-escape-hatch/cases/03-async-metadata.tsx","line_end":34,"line_start":30}]},{"factor":"env_access","evidence":[{"file":"assets/test-corpus/tier-4-escape-hatch/validate.sh","line_end":41,"line_start":29},{"file":"scripts/render_diff.sh","line_end":25,"line_start":20}]}],"critical_findings":[],"high_findings":[{"title":"Validation Harness Executes Local Toolchains","verdict":"TRUE_POSITIVE","locations":[{"file":"assets/test-corpus/run.sh","line_end":135,"line_start":128},{"file":"assets/test-corpus/run.sh","line_end":164,"line_start":141}],"confidence":0.88,"description":"The test corpus runner can install npm dependencies and run Remotion, HyperFrames, node, ffmpeg, and shell scripts. This is expected for video translation validation, but marketplace users should treat it as executable build tooling and run it only in a controlled workspace.","confidence_reasoning":"The cited lines directly execute npm, npx Remotion, node HyperFrames, and local diff scripts. The behavior is legitimate validation work, but it is real command execution with dependency and media-processing risk."}],"medium_findings":[{"title":"Video Diff Scripts Process User-Supplied Files","verdict":"TRUE_POSITIVE","locations":[{"file":"scripts/frame_strip.sh","line_end":105,"line_start":52},{"file":"scripts/render_diff.sh","line_end":64,"line_start":56}],"confidence":0.78,"description":"The frame-strip and render-diff utilities pass provided video paths to ffprobe and ffmpeg through subprocess calls. Arguments are structured arrays or quoted shell variables, so command injection evidence is low, but malformed media can still exercise native parsers.","confidence_reasoning":"The subprocess calls are visible and operate on caller-provided media files. They do not concatenate shell commands, which lowers injection risk, but the native toolchain exposure is still meaningful."},{"title":"Network Examples Are Present In Fixtures","verdict":"TRUE_POSITIVE","locations":[{"file":"assets/test-corpus/tier-4-escape-hatch/cases/03-async-metadata.tsx","line_end":34,"line_start":30},{"file":"assets/test-corpus/tier-3-data-driven/hf-src/index.html","line_end":6,"line_start":6}],"confidence":0.72,"description":"The repository contains fixture code with fetch calls and CDN-hosted GSAP. These appear to be examples for lint detection and rendered fixtures, not hidden data exfiltration, but they can create outbound network behavior if executed in an unrestricted environment.","confidence_reasoning":"The fetch and external script URL are explicit. Context indicates fixture coverage and standard CDN use, so confidence is high for network behavior but lower for malicious intent."}],"low_findings":[{"title":"Static Analyzer Reported Many Documentation False Positives","verdict":"FALSE_POSITIVE","locations":[{"file":"SKILL.md","line_end":90,"line_start":75},{"file":"assets/test-corpus/tier-1-title-card/README.md","line_end":38,"line_start":28},{"file":"references/api-map.md","line_end":24,"line_start":16}],"confidence":0.91,"description":"Most external command alerts in markdown files are inline code examples, API mapping tables, or fenced shell snippets. They are not executed by the skill unless a user intentionally follows the documentation.","confidence_reasoning":"The cited locations are documentation and markdown tables, not executable source files. They explain validation commands and translation mappings."},{"title":"Weak Crypto Alerts Are SSIM Metric Text","verdict":"FALSE_POSITIVE","locations":[{"file":"assets/test-corpus/tier-1-title-card/expected.json","line_end":17,"line_start":5}],"confidence":0.89,"description":"Weak cryptographic algorithm alerts on expected JSON and references are false positives. The cited expected file stores SSIM validation metrics and composition metadata, not hashing or encryption code.","confidence_reasoning":"The file content is video fixture metadata and measured SSIM values. No cryptographic operation is present in the inspected context."},{"title":"Prompt Injection Search Found No Evidence","verdict":"FALSE_POSITIVE","locations":[{"file":"SKILL.md","line_end":12,"line_start":1}],"confidence":0.86,"description":"A targeted search for common prompt-injection phrases found no matching text in the skill files. No file content attempted to override audit instructions or claim special review authority.","confidence_reasoning":"The skill header and overview define the intended conversion scope. No suspicious override language was found during targeted repository search."}],"dangerous_patterns":[{"title":"Shell Orchestrator Runs Project Commands","verdict":"TRUE_POSITIVE","locations":[{"file":"assets/test-corpus/run.sh","line_end":164,"line_start":128}],"confidence":0.86,"description":"The corpus runner launches dependency installation, rendering, diffing, and strip generation commands. This pattern is dangerous if run on untrusted projects without isolation.","confidence_reasoning":"The shell script directly launches multiple project commands. The commands are purposeful and local, but they should be sandboxed for marketplace use."},{"title":"Python Subprocess Invokes ffprobe And ffmpeg","verdict":"TRUE_POSITIVE","locations":[{"file":"scripts/frame_strip.sh","line_end":105,"line_start":52}],"confidence":0.8,"description":"The frame-strip helper invokes ffprobe and ffmpeg from Python subprocesses using caller-supplied video paths. This is a real external command pattern with media parser exposure.","confidence_reasoning":"The code uses structured subprocess arguments, which mitigates shell injection. The external parser exposure is still confirmed."}],"files_scanned":64,"total_lines":4619,"audit_model":"codex","audited_at":"2026-06-30T02:28:29.034+00:00","created_at":"2026-06-30T03:14:00.073874+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":3,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":3,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}