Audit-Verlauf

scripts/make-theme.cjs:8763-8766

Project Metadata Can Inject AWK Code

A project plan value is read and later interpolated into an AWK program. A crafted project file can execute unintended local commands during rendering.

The script reads project-controlled FPS through node evaluation and uses it in generated shell processing, creating an injection boundary.

Hoch

Theme Values Reach an Executed Shell Script

Theme-derived values are written into a post-processing shell script that the rendering workflow executes. Untrusted theme data can therefore alter shell behavior.

The cited template constructs shell command substitution from theme values, and the skill includes a renderer that runs generated shell scripts.

Hoch

scripts/render-and-composite.sh:256 scripts/render-and-composite.sh:299

Untrusted Render Content Has Network Access

Project-controlled HTML is rendered in Chromium while assets are staged through symlinks. Without network isolation, hostile render content can make network requests from the rendering environment.

The renderer processes project content and creates symlinked staging assets; no network sandbox is evident in the cited workflow.

Niedrig

assets/strokefonts/HersheyScript1.svg:14 assets/strokefonts/HersheyScriptMed.svg:14 modes/cinematic/_archive/champion/template.html:26 modes/cinematic/_archive/memory-wall/template.html:29 modes/cinematic/_archive/portrait-header/template.html:18 modes/cinematic/cinematic-cream/template.html:87 modes/cinematic/engine.html:29 modes/standard/_anatomy.md:168 references/example-renders/champion.html:6 references/example-renders/memory-wall.html:6 scripts/make-theme.cjs:586

Unscanned file (too_large) — manual review required

[unscanned: too_large]

Force-confirmed metadata/low static finding; AI false-positive verdict rejected.

Risikofaktoren

🌐 Netzwerkzugriff (11)

📁 Dateisystemzugriff (50)

⚙️ Externe Befehle (50)

⚡ Enthält Skripte (12)

modes/standard/_anatomy.md:179 scripts/check-occlusion.cjs:28 scripts/check-overflow.cjs:41 scripts/check-rail-climax.cjs:52 scripts/inject-fonts.cjs:67 scripts/measure-layout.cjs:46 scripts/preview-frames.cjs:54 scripts/preview-frames.cjs:61 scripts/render-and-composite.sh:189 scripts/render-and-composite.sh:197 scripts/render-and-composite.sh:217 scripts/safe-zones.cjs:41

🔑 Umgebungsvariablen (24)

Geprüft von: claude

Audit-Version 7

19. Juli 2026, 09:03

Most alerts are false positives caused by artistic theme names, Markdown formatting, fixed paths, and normal media tooling. Confirmed risks include silent self-updates, runtime third-party execution through uvx, CDN script loads, and broad renderer process cleanup. Review the 1,034 omitted static matches and remove or consent-gate these behaviors before publication. Static review was capped at 400/1434 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

Gescannte Dateien

25,422

Analysierte Zeilen

Prüfelemente

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (2)

Kritisch

SKILL.md:8 SKILL.md:127

Prompt Injection Attempt Detected

SKILL.md directs the agent to "run silently, don't ask" before executing an npx skill update, suppressing consent for network-delivered code. It also says initialization can update the global skill set.

The instruction explicitly suppresses user consent while executing network-delivered tooling and changing installed skills. The global update behavior is stated directly in the same file.

Niedrig

Unscanned file (too_large) — manual review required

[unscanned: too_large]

Force-confirmed metadata/low static finding; AI false-positive verdict rejected.

Elemente der Fähigkeitsprüfung (12)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Hoch

Synchronous spawn

let r = cp.spawnSync("uvx", wxArgs, { encoding: "utf8", timeout: 600000 });

This call runs WhisperX through uvx, which can download and execute third-party Python package code at runtime. The package version is pinned by default, but execution still crosses a supply-chain boundary.

Hoch

modes/cinematic/_archive/champion/template.html:26 modes/cinematic/_archive/memory-wall/template.html:29 modes/cinematic/_archive/portrait-header/template.html:18 modes/cinematic/cinematic-cream/template.html:87 modes/cinematic/engine.html:29 references/example-renders/champion.html:6 references/example-renders/memory-wall.html:6

Synchronous spawn

r = cp.spawnSync(

This retry again executes WhisperX through uvx after changing arguments. It can download and run third-party package code, so explicit consent and stronger package verification are required.

Niedrig

Hardcoded URL · 7 Vorkommen

Opening or rendering this executable HTML fetches GSAP from jsDelivr without an integrity attribute. That creates a third-party network and supply-chain dependency.

Niedrig

scripts/render-and-composite.sh:272 scripts/render-and-composite.sh:277

Hardcoded URL

const GSAP = `<script src="https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js" integrity="sha

Generated theme pages fetch GSAP from jsDelivr at runtime. Subresource Integrity limits content tampering, but the network, privacy, and availability dependency remains.

Niedrig

Standard device file access · 2 Vorkommen

pkill -9 -f "puppeteer_dev_chrome_profile" 2>/dev/null

The device redirection is harmless, but this line also runs a broad pkill pattern for Puppeteer profiles. It can terminate unrelated browser processes owned by the same user.

Risikofaktoren

🌐 Netzwerkzugriff (11)

📁 Dateisystemzugriff (50)

⚙️ Externe Befehle (50)

⚡ Enthält Skripte (12)

🔑 Umgebungsvariablen (24)

Geprüft von: codex

Audit-Version 6

10. Juli 2026, 16:36

Most scanner alerts are false positives caused by artistic theme names, Markdown backticks, fixed path resolution, and local media tooling. Confirmed risks include silent self-update instructions, runtime third-party execution through uvx, CDN script loads, and broad process cleanup. The skill should not publish until these behaviors are removed or require explicit consent. Static review was capped at 400/1481 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

Gescannte Dateien

25,458

Analysierte Zeilen

Prüfelemente

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (2)

Kritisch

SKILL.md:8 SKILL.md:127

Silent Self-Update Instruction

SKILL.md tells the agent to "run silently, don't ask" before executing an npx skill update. It also states that initialization can update the global skill set.

The instruction explicitly suppresses user consent while executing network-delivered tooling and changing installed skills. The global update behavior is stated directly in the same file.

Niedrig

Unscanned file (too_large) — manual review required

[unscanned: too_large]

Force-confirmed metadata/low static finding; AI false-positive verdict rejected.

Elemente der Fähigkeitsprüfung (12)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Hoch

Synchronous spawn

let r = cp.spawnSync("uvx", wxArgs, { encoding: "utf8", timeout: 600000 });

Hoch

Synchronous spawn

r = cp.spawnSync(

This retry again executes WhisperX through uvx after changing arguments. It can download and run third-party package code, so explicit consent and stronger package verification are required.

Niedrig

Hardcoded URL · 7 Vorkommen

Opening or rendering this executable HTML fetches GSAP from jsDelivr without an integrity attribute. That creates a third-party network and supply-chain dependency.

Niedrig

scripts/render-and-composite.sh:272 scripts/render-and-composite.sh:277

Hardcoded URL

const GSAP = `<script src="https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js" integrity="sha

Generated theme pages fetch GSAP from jsDelivr at runtime. Subresource Integrity limits content tampering, but the network, privacy, and availability dependency remains.

Niedrig

Standard device file access · 2 Vorkommen

pkill -9 -f "puppeteer_dev_chrome_profile" 2>/dev/null

The device redirection is harmless, but this line also runs a broad pkill pattern for Puppeteer profiles. It can terminate unrelated browser processes owned by the same user.

Risikofaktoren

🌐 Netzwerkzugriff (11)

📁 Dateisystemzugriff (50)

⚙️ Externe Befehle (50)

⚡ Enthält Skripte (12)

🔑 Umgebungsvariablen (24)

Geprüft von: codex

Audit-Version 5

10. Juli 2026, 16:36

Gescannte Dateien

25,458

Analysierte Zeilen

Prüfelemente

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (2)

Kritisch

SKILL.md:8 SKILL.md:127

Silent Self-Update Instruction

SKILL.md tells the agent to "run silently, don't ask" before executing an npx skill update. It also states that initialization can update the global skill set.

The instruction explicitly suppresses user consent while executing network-delivered tooling and changing installed skills. The global update behavior is stated directly in the same file.

Niedrig

Unscanned file (too_large) — manual review required

[unscanned: too_large]

Force-confirmed metadata/low static finding; AI false-positive verdict rejected.

Elemente der Fähigkeitsprüfung (12)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Hoch

Synchronous spawn

let r = cp.spawnSync("uvx", wxArgs, { encoding: "utf8", timeout: 600000 });

Hoch

Synchronous spawn

r = cp.spawnSync(

This retry again executes WhisperX through uvx after changing arguments. It can download and run third-party package code, so explicit consent and stronger package verification are required.

Niedrig

Hardcoded URL · 7 Vorkommen

Opening or rendering this executable HTML fetches GSAP from jsDelivr without an integrity attribute. That creates a third-party network and supply-chain dependency.

Niedrig

scripts/render-and-composite.sh:272 scripts/render-and-composite.sh:277

Hardcoded URL

const GSAP = `<script src="https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js" integrity="sha

Generated theme pages fetch GSAP from jsDelivr at runtime. Subresource Integrity limits content tampering, but the network, privacy, and availability dependency remains.

Niedrig

Standard device file access · 2 Vorkommen

pkill -9 -f "puppeteer_dev_chrome_profile" 2>/dev/null

The device redirection is harmless, but this line also runs a broad pkill pattern for Puppeteer profiles. It can terminate unrelated browser processes owned by the same user.

Risikofaktoren

🌐 Netzwerkzugriff (11)

📁 Dateisystemzugriff (50)

⚙️ Externe Befehle (50)

⚡ Enthält Skripte (12)

🔑 Umgebungsvariablen (24)

Geprüft von: codex

Audit-Version 4

8. Juli 2026, 02:05

The critical ransom-related static findings are false positives caused by caption theme names and visual-style prose. Real risks remain: the skill executes local commands, reads and writes project files, creates symlinks, loads CDN scripts in generated HTML, and can download packages or model weights during runtime.

Gescannte Dateien

25,451

Analysierte Zeilen

359

Prüfelemente

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (2)

Hoch

SKILL.md:280-284 scripts/transcribe.cjs:181-205 scripts/matte.cjs:7

Runtime Package and Model Downloads

The skill documentation and scripts state that WhisperX can be run through uvx and that matting weights can download into the user cache on first run. This is legitimate functionality, but it creates a network and supply-chain risk not fully represented by simple URL scans.

The docs explicitly mention uvx transcription and model downloads, and transcribe.cjs builds a uvx WhisperX invocation. This is direct evidence of runtime package or model resolution.

Niedrig

scripts/audio-envelope.cjs:15 scripts/check-occlusion.cjs:10 scripts/make-cinematic.cjs:172 scripts/make-composition.cjs:18 scripts/matte.cjs:31 scripts/transcribe.cjs:13

Unscanned file (too_large) — manual review required

[unscanned: too_large]

The file was not statically scanned because it is binary or oversized. The asset appears to be a font resource, but opaque bundled content still needs provenance and manual review.

Elemente der Fähigkeitsprüfung (352)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Hoch

Node.js child_process module · 6 Vorkommen

const cp = require("child_process");

The script imports child_process and later executes local tools used by the render pipeline. This is expected functionality, but it grants the skill external command execution capability.

Hoch

scripts/audio-envelope.cjs:54

Synchronous file execution

out = cp.execFileSync(

The script calls execFileSync to run tools such as ffmpeg, ffprobe, node, python3, or Hyperframes with project media paths. Argument arrays reduce shell injection risk, but the external execution capability is real.

Hoch

scripts/check-occlusion.cjs:44

Synchronous file execution

cp.execFileSync("node", [path.join(__dirname, "measure-layout.cjs"), project], {

Hoch

scripts/make-cinematic.cjs:715

Node.js child_process module

const cp2 = require("child_process");

The script imports child_process and later executes local tools used by the render pipeline. This is expected functionality, but it grants the skill external command execution capability.

Hoch

scripts/make-cinematic.cjs:179 scripts/matte.cjs:114 scripts/matte.cjs:176 scripts/matte.cjs:227 scripts/transcribe.cjs:157

Node.js child_process module

require("child_process").spawnSync(

The script imports child_process and later executes local tools used by the render pipeline. This is expected functionality, but it grants the skill external command execution capability.

Hoch

Synchronous file execution · 5 Vorkommen

cp.execFileSync(

Hoch

scripts/make-cinematic.cjs:716

Synchronous spawn

let r = cp2.spawnSync("node", [path.join(__dirname, "make-composition.cjs"), project], {

The script calls spawnSync to run local or package-managed tools during transcription, matting, rendering, or validation. This is legitimate for the workflow but remains a real external command risk.

Hoch

scripts/make-cinematic.cjs:756 scripts/make-cinematic.cjs:925

Synchronous spawn · 2 Vorkommen

cp2.spawnSync(

The script calls spawnSync to run local or package-managed tools during transcription, matting, rendering, or validation. This is legitimate for the workflow but remains a real external command risk.

Hoch

scripts/make-cinematic.cjs:798 scripts/make-cinematic.cjs:1198

Synchronous spawn · 2 Vorkommen

cp2.spawnSync("node", [path.join(__dirname, "make-composition.cjs"), project], {

The script calls spawnSync to run local or package-managed tools during transcription, matting, rendering, or validation. This is legitimate for the workflow but remains a real external command risk.

Hoch

scripts/make-cinematic.cjs:1147

Synchronous spawn

require("child_process").spawnSync(

The script calls spawnSync to run local or package-managed tools during transcription, matting, rendering, or validation. This is legitimate for the workflow but remains a real external command risk.

Hoch

Synchronous spawn

r = cp2.spawnSync("node", [path.join(__dirname, "make-composition.cjs"), project], {

The script calls spawnSync to run local or package-managed tools during transcription, matting, rendering, or validation. This is legitimate for the workflow but remains a real external command risk.

Hoch

scripts/make-cinematic.cjs:1163

Synchronous spawn

cp2.spawnSync("node", [path.join(__dirname, "measure-layout.cjs"), project, String(midT)], {

The script calls spawnSync to run local or package-managed tools during transcription, matting, rendering, or validation. This is legitimate for the workflow but remains a real external command risk.

Hoch

scripts/make-composition.cjs:44

Synchronous file execution

.execFileSync(

Hoch

scripts/make-theme.cjs:39

Node.js child_process module

const { execFileSync } = require("child_process");

The script imports child_process and later executes local tools used by the render pipeline. This is expected functionality, but it grants the skill external command execution capability.

Hoch

scripts/make-theme.cjs:70

Synchronous file execution

const out = execFileSync(

Hoch

scripts/make-theme.cjs:1284 scripts/make-theme.cjs:7013 scripts/make-theme.cjs:7183

Synchronous file execution · 3 Vorkommen

const D = execFileSync(

Hoch

scripts/make-theme.cjs:7676 scripts/make-theme.cjs:7903 scripts/make-theme.cjs:8112

Synchronous file execution · 3 Vorkommen

let D = execFileSync(

Hoch

scripts/matte.cjs:77

Synchronous file execution

.execFileSync("ffprobe", [

Hoch

scripts/matte.cjs:215

Synchronous spawn

const r = cp.spawnSync("node", [hfCli(), "remove-background", matteSrc, "-o", mov], {

The script calls spawnSync to run local or package-managed tools during transcription, matting, rendering, or validation. This is legitimate for the workflow but remains a real external command risk.

Hoch

Hidden file in home directory

* weights — the model auto-downloads once (~168 MB) to ~/.cache/hyperframes/.

The skill documents or uses hidden cache paths under the user home directory for model weights. This is a real home-directory side effect and should be disclosed and constrained.

Hoch

scripts/render-and-composite.sh:299

Symlink creation · 2 Vorkommen

fs.symlinkSync(path.basename(found), src);

The script creates symlinks for discovered media or render assets inside the project workflow. This is intended, but symlink handling can redirect file access when run on untrusted project directories.

Hoch

Symlink creation

ln -sf "$p" "$sh/$b"

Hoch

scripts/transcribe.cjs:172

Synchronous file execution

cp.execFileSync("ffmpeg", ["-y", "-i", src, "-vn", "-ac", "1", "-ar", "16000", wav], {

Hoch

scripts/transcribe.cjs:255

Synchronous file execution

const so = cp.execFileSync("node", [cli, ...args], { encoding: "utf8" });

Hoch

scripts/transcribe.cjs:57 scripts/transcribe.cjs:77

Synchronous spawn · 2 Vorkommen

const r = cp.spawnSync(

The script calls spawnSync to run local or package-managed tools during transcription, matting, rendering, or validation. This is legitimate for the workflow but remains a real external command risk.

Hoch

Synchronous spawn

let r = cp.spawnSync("uvx", wxArgs, { encoding: "utf8", timeout: 600000 });

The script calls spawnSync to run local or package-managed tools during transcription, matting, rendering, or validation. This is legitimate for the workflow but remains a real external command risk.

Hoch

Synchronous spawn

r = cp.spawnSync(

The script calls spawnSync to run local or package-managed tools during transcription, matting, rendering, or validation. This is legitimate for the workflow but remains a real external command risk.

Hoch

Hidden file in home directory

- **Node-first; two Python touchpoints via `uvx` (no manual installs):** transcription runs WhisperX

The skill documents or uses hidden cache paths under the user home directory for model weights. This is a real home-directory side effect and should be disclosed and constrained.

Hoch

Hidden file in home directory

- Matting weights are NOT bundled: `matte.cjs` shells the hyperframes CLI's `remove-background`, whi

The skill documents or uses hidden cache paths under the user home directory for model weights. This is a real home-directory side effect and should be disclosed and constrained.

Mittel

Node.js fs operations

fs.writeFileSync(path.join(project, "envelope.json"), JSON.stringify({ hop: HOP, rms }));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Synchronous file operations

fs.writeFileSync(path.join(project, "envelope.json"), JSON.stringify({ hop: HOP, rms }));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/check-occlusion.cjs:23

Dynamic require with variable

if (fs.existsSync(c)) return require(c);

The script dynamically requires packages resolved from HYPERFRAMES_ROOT or node_modules paths. This is intended dependency loading, but an attacker-controlled checkout path could affect what code is loaded.

Mittel

Node.js fs operations

for (const d of fs.readdirSync(bun))

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations

return JSON.parse(fs.readFileSync(lp, "utf8"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations

const plan = fs.existsSync(planPath) ? JSON.parse(fs.readFileSync(planPath, "utf8")) : {};

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Synchronous file operations

return JSON.parse(fs.readFileSync(lp, "utf8"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/check-overflow.cjs:31 scripts/check-rail-climax.cjs:33 scripts/preview-frames.cjs:37 scripts/safe-zones.cjs:35

Synchronous file operations

const plan = fs.existsSync(planPath) ? JSON.parse(fs.readFileSync(planPath, "utf8")) : {};

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations · 4 Vorkommen

for (const d of fs.readdirSync(bunDir))

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations

const html = fs.readFileSync(indexPath, "utf8");

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/check-rail-climax.cjs:58 scripts/preview-frames.cjs:66

Synchronous file operations

const html = fs.readFileSync(indexPath, "utf8");

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations · 2 Vorkommen

if (g) gsapSource = fs.readFileSync(g, "utf8");

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/check-rail-climax.cjs:58 scripts/preview-frames.cjs:66

Synchronous file operations · 2 Vorkommen

if (g) gsapSource = fs.readFileSync(g, "utf8");

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/check-timing.cjs:55 scripts/preview-frames.cjs:161

Node.js fs operations · 2 Vorkommen

const plan = JSON.parse(fs.readFileSync(path.join(project, "plan.json"), "utf8"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/check-timing.cjs:55 scripts/preview-frames.cjs:161

Node.js fs operations

const t = JSON.parse(fs.readFileSync(path.join(project, "transcript.json"), "utf8"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Synchronous file operations · 2 Vorkommen

const plan = JSON.parse(fs.readFileSync(path.join(project, "plan.json"), "utf8"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/fill-timings.cjs:73 scripts/fit-fonts.cjs:95

Synchronous file operations

const t = JSON.parse(fs.readFileSync(path.join(project, "transcript.json"), "utf8"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations · 2 Vorkommen

plan = JSON.parse(fs.readFileSync(planPath, "utf8"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/fill-timings.cjs:113 scripts/fit-fonts.cjs:154

Node.js fs operations

trWordsRaw = JSON.parse(fs.readFileSync(trPath, "utf8")).words || [];

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations · 2 Vorkommen

fs.writeFileSync(planPath, JSON.stringify(plan, null, 2));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/fill-timings.cjs:73 scripts/fit-fonts.cjs:95

Synchronous file operations · 2 Vorkommen

plan = JSON.parse(fs.readFileSync(planPath, "utf8"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/fill-timings.cjs:113 scripts/fit-fonts.cjs:154

Synchronous file operations

trWordsRaw = JSON.parse(fs.readFileSync(trPath, "utf8")).words || [];

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Synchronous file operations · 2 Vorkommen

fs.writeFileSync(planPath, JSON.stringify(plan, null, 2));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations

css = fs.readFileSync(FONTS_CSS, "utf8");

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/inject-fonts.cjs:131 scripts/inject-fonts.cjs:142

Node.js fs operations

html = fs.readFileSync(file, "utf8");

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations · 2 Vorkommen

fs.writeFileSync(file, html);

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Synchronous file operations

css = fs.readFileSync(FONTS_CSS, "utf8");

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/inject-fonts.cjs:131 scripts/inject-fonts.cjs:142

Synchronous file operations

html = fs.readFileSync(file, "utf8");

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Synchronous file operations · 2 Vorkommen

fs.writeFileSync(file, html);

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/lib-dna.cjs:42 scripts/lib-dna.cjs:47 scripts/make-theme.cjs:98

Node.js fs operations · 3 Vorkommen

return JSON.parse(fs.readFileSync(p, "utf8"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/lib-dna.cjs:42 scripts/lib-dna.cjs:47 scripts/make-theme.cjs:98

Synchronous file operations · 3 Vorkommen

return JSON.parse(fs.readFileSync(p, "utf8"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations

const C = JSON.parse(fs.readFileSync(cj, "utf8"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations

const tr = (JSON.parse(fs.readFileSync(tj, "utf8")).words || []).filter(

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/make-cinematic.cjs:174

Node.js fs operations

sz = JSON.parse(fs.readFileSync(path.join(project, "safe-zones.json"), "utf8"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations

fs.readdirSync(project).filter((x) => /\.(mp4|mov|webm)$/i.test(x)),

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/make-cinematic.cjs:708 scripts/make-cinematic.cjs:797 scripts/make-cinematic.cjs:859 scripts/make-cinematic.cjs:1146 scripts/make-cinematic.cjs:1197

Node.js fs operations · 5 Vorkommen

fs.writeFileSync(path.join(project, "plan.json"), JSON.stringify(plan, null, 2));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/make-cinematic.cjs:802 scripts/make-cinematic.cjs:1151 scripts/make-cinematic.cjs:1193

Node.js fs operations

lay = JSON.parse(fs.readFileSync(path.join(project, "_layout.json"), "utf8"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations · 3 Vorkommen

fs.unlinkSync(path.join(project, "_layout.json"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations

const ss = JSON.parse(fs.readFileSync(path.join(project, "_layout.json"), "utf8")).samples;

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations

JSON.parse(fs.readFileSync(path.join(project, "_layout.json"), "utf8")).samples[0].caps ||

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Synchronous file operations

const C = JSON.parse(fs.readFileSync(cj, "utf8"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Synchronous file operations

const tr = (JSON.parse(fs.readFileSync(tj, "utf8")).words || []).filter(

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/make-cinematic.cjs:708 scripts/make-cinematic.cjs:797 scripts/make-cinematic.cjs:859 scripts/make-cinematic.cjs:1146 scripts/make-cinematic.cjs:1197

Synchronous file operations

sz = JSON.parse(fs.readFileSync(path.join(project, "safe-zones.json"), "utf8"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Synchronous file operations · 5 Vorkommen

fs.writeFileSync(path.join(project, "plan.json"), JSON.stringify(plan, null, 2));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Synchronous file operations

lay = JSON.parse(fs.readFileSync(path.join(project, "_layout.json"), "utf8"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Synchronous file operations

const ss = JSON.parse(fs.readFileSync(path.join(project, "_layout.json"), "utf8")).samples;

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Synchronous file operations

JSON.parse(fs.readFileSync(path.join(project, "_layout.json"), "utf8")).samples[0].caps ||

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations

const plan = JSON.parse(fs.readFileSync(planPath, "utf8"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations

? fs.readFileSync(path.join(TEMPLATES, "engine.html"), "utf8")

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations

: fs.readFileSync(findTemplate(plan.template), "utf8");

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations

fs.writeFileSync(path.join(project, "index.html"), src);

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations

fs.writeFileSync(path.join(project, "index_fg.html"), fg);

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Synchronous file operations

const plan = JSON.parse(fs.readFileSync(planPath, "utf8"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Synchronous file operations

? fs.readFileSync(path.join(TEMPLATES, "engine.html"), "utf8")

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Synchronous file operations

: fs.readFileSync(findTemplate(plan.template), "utf8");

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Synchronous file operations

fs.writeFileSync(path.join(project, "index.html"), src);

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/make-theme.cjs:8766

Synchronous file operations

fs.writeFileSync(path.join(project, "index_fg.html"), fg);

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Shell command substitution

cd "$(dirname "$0")"

The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.

Mittel

scripts/make-theme.cjs:8763-8773

Template literal with command substitution

`#!/usr/bin/env bash

This JavaScript emits a shell script containing command substitution and interpolated render settings. It is part of the intended post-processing path, but generated shell execution is a real risk surface.

Mittel

Node.js fs operations

const theme = JSON.parse(fs.readFileSync(path.join(PROJECT, "theme.json"), "utf8"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations

const dna = JSON.parse(fs.readFileSync(path.join(SKILL, "themes", theme.dna + ".json"), "utf8"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations

const transcript = JSON.parse(fs.readFileSync(path.join(PROJECT, "transcript.json"), "utf8"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/make-theme.cjs:85

Node.js fs operations

fs.readFileSync(path.join(PROJECT, "matte.fps"), "utf8").replace(/\D/g, ""),

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations

const n = fs.readdirSync(path.join(PROJECT, "frames_fg")).length;

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/make-theme.cjs:517 scripts/make-theme.cjs:5138

Node.js fs operations

return JSON.parse(fs.readFileSync(path.join(SKILL, "assets/fonts/char-widths.json"), "utf8"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations · 2 Vorkommen

fs.readFileSync(path.join(SKILL, "assets/brand/cyberpunk-widths.json"), "utf8"),

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations

css = fs.readFileSync(path.join(SKILL, "modes/standard/fonts/fonts.css"), "utf8");

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations

fs.writeFileSync(path.join(PROJECT, "index.html"), bgHtml);

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/make-theme.cjs:8732

Node.js fs operations

fs.writeFileSync(path.join(PROJECT, "rail.html"), fgHtml);

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations

fs.unlinkSync(path.join(PROJECT, "rail.html"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/make-theme.cjs:8761 scripts/transcribe.cjs:298

Node.js fs operations · 2 Vorkommen

fs.writeFileSync(

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Synchronous file operations

const theme = JSON.parse(fs.readFileSync(path.join(PROJECT, "theme.json"), "utf8"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Synchronous file operations

const dna = JSON.parse(fs.readFileSync(path.join(SKILL, "themes", theme.dna + ".json"), "utf8"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Synchronous file operations

const transcript = JSON.parse(fs.readFileSync(path.join(PROJECT, "transcript.json"), "utf8"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Synchronous file operations

fs.readFileSync(path.join(PROJECT, "matte.fps"), "utf8").replace(/\D/g, ""),

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/make-theme.cjs:517 scripts/make-theme.cjs:5138

Synchronous file operations

return JSON.parse(fs.readFileSync(path.join(SKILL, "assets/fonts/char-widths.json"), "utf8"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Synchronous file operations · 2 Vorkommen

fs.readFileSync(path.join(SKILL, "assets/brand/cyberpunk-widths.json"), "utf8"),

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/make-theme.cjs:5141

Synchronous file operations

css = fs.readFileSync(path.join(SKILL, "modes/standard/fonts/fonts.css"), "utf8");

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Synchronous file operations

.readFileSync(path.join(SKILL, "assets/brand/CyberpunkReplica.ttf"))

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Synchronous file operations

fs.writeFileSync(path.join(PROJECT, "index.html"), bgHtml);

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/make-theme.cjs:8761 scripts/transcribe.cjs:298

Synchronous file operations

fs.writeFileSync(path.join(PROJECT, "rail.html"), fgHtml);

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Synchronous file operations · 2 Vorkommen

fs.writeFileSync(

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/matte.cjs:58 scripts/transcribe.cjs:44

Node.js fs operations · 2 Vorkommen

fs.symlinkSync(path.basename(found), src);

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations · 2 Vorkommen

fs.copyFileSync(found, src);

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/matte.cjs:112

Node.js fs operations

fs.mkdirSync(dst, { recursive: true });

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/matte.cjs:113

Node.js fs operations

if (fs.readdirSync(dst).some((f) => f.endsWith(".png"))) return false;

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/matte.cjs:124

Node.js fs operations

return fs.readdirSync(dir).filter((f) => f.endsWith(".png")).length;

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations

fps = parseInt(fs.readFileSync(fpsFile, "utf8").replace(/\D/g, ""), 10) || 0;

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/matte.cjs:255 scripts/matte.cjs:265

Node.js fs operations

fs.writeFileSync(fpsFile, String(fps));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/matte.cjs:226

Node.js fs operations

fs.mkdirSync(framesFg, { recursive: true });

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/matte.cjs:232

Node.js fs operations

fs.rmSync(mov, { force: true });

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/matte.cjs:253

Node.js fs operations

fs.mkdirSync(tmp, { recursive: true });

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations · 2 Vorkommen

fs.copyFileSync(

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/matte.cjs:260

Node.js fs operations

fs.rmSync(framesFg, { recursive: true, force: true });

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/matte.cjs:261

Node.js fs operations

fs.renameSync(tmp, framesFg);

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Synchronous file operations

fps = parseInt(fs.readFileSync(fpsFile, "utf8").replace(/\D/g, ""), 10) || 0;

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Synchronous file operations

fs.writeFileSync(fpsFile, String(fps));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/measure-layout.cjs:35 scripts/measure-layout.cjs:75

Hidden file access

* weights — the model auto-downloads once (~168 MB) to ~/.cache/hyperframes/.

The code or documentation references hidden or home-directory cache paths used by the render pipeline. This is expected for model caching but still a real local filesystem side effect.

Mittel

Node.js fs operations · 2 Vorkommen

for (const d of fs.readdirSync(bunDir)) {

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations

gsapSource = fs.readFileSync(p, "utf8");

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/measure-layout.cjs:188 scripts/preview-frames.cjs:106

Node.js fs operations

if (fs.existsSync(planPath)) plan = JSON.parse(fs.readFileSync(planPath, "utf8"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations · 2 Vorkommen

await page.addStyleTag({ content: fs.readFileSync(fontsCss, "utf8") });

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations

fs.writeFileSync(outPath, JSON.stringify(layout, null, 2));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Synchronous file operations

gsapSource = fs.readFileSync(p, "utf8");

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/measure-layout.cjs:188 scripts/preview-frames.cjs:106

Synchronous file operations

if (fs.existsSync(planPath)) plan = JSON.parse(fs.readFileSync(planPath, "utf8"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Synchronous file operations · 2 Vorkommen

await page.addStyleTag({ content: fs.readFileSync(fontsCss, "utf8") });

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/prepare.sh:17 scripts/render-and-composite.sh:13 scripts/render-theme.sh:8

Synchronous file operations

fs.writeFileSync(outPath, JSON.stringify(layout, null, 2));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Shell command substitution · 3 Vorkommen

PROJECT="$(cd "$PROJECT" && pwd)"

Mittel

scripts/prepare.sh:18 scripts/render-theme.sh:9

Shell command substitution · 2 Vorkommen

SD="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

Mittel

scripts/preview-frames.cjs:147 scripts/safe-zones.cjs:582

Node.js fs operations · 2 Vorkommen

String(fs.readFileSync(path.join(project, "matte.fps"), "utf8")).replace(/[^\d.]/g, ""),

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/preview-frames.cjs:180

Node.js fs operations

JSON.parse(fs.readFileSync(path.join(project, "plan.json"), "utf8")).caption_layer === "fg";

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations

? fs.readdirSync(path.join(project, "frames_bg")).length

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/preview-frames.cjs:200 scripts/transcribe.cjs:176

Node.js fs operations · 2 Vorkommen

fs.mkdirSync(outDir, { recursive: true });

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/preview-frames.cjs:147 scripts/safe-zones.cjs:582

Synchronous file operations · 2 Vorkommen

String(fs.readFileSync(path.join(project, "matte.fps"), "utf8")).replace(/[^\d.]/g, ""),

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/render-and-composite.sh:18

Synchronous file operations

JSON.parse(fs.readFileSync(path.join(project, "plan.json"), "utf8")).caption_layer === "fg";

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Shell command substitution

SKILL_SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

Mittel

scripts/render-and-composite.sh:20

Shell command substitution

for cand in "${2:-}" "${HYPERFRAMES_ROOT:-}" "$(cd "$SKILL_SCRIPT_DIR/../../.." 2>/dev/null && pwd)"

Mittel

scripts/render-and-composite.sh:43 scripts/render-and-composite.sh:58 scripts/render-and-composite.sh:64

Shell command substitution · 3 Vorkommen

C="$(compiler_for)"

Mittel

scripts/render-and-composite.sh:45 scripts/render-and-composite.sh:60

Shell command substitution · 2 Vorkommen

node "$(dirname "$0")/$C" "$PROJECT"

Mittel

scripts/render-and-composite.sh:49 scripts/render-and-composite.sh:56

Shell command substitution · 2 Vorkommen

node "$(dirname "$0")/make-cinematic.cjs" "$PROJECT"

Mittel

scripts/render-and-composite.sh:69

Shell command substitution

ENGINE="$(dirname "$0")/../modes/cinematic/engine.html"

Mittel

scripts/render-and-composite.sh:70

Shell command substitution

if [[ "$(dirname "$0")/$RECOMPILER" -nt "$PROJECT/index.html" || "$(dirname "$0")/lib-dna.cjs" -nt "

Mittel

scripts/render-and-composite.sh:72

Shell command substitution

node "$(dirname "$0")/$RECOMPILER" "$PROJECT"

Mittel

scripts/render-and-composite.sh:84

Shell command substitution

node "$(dirname "$0")/inject-fonts.cjs" "$PROJECT" \

Mittel

scripts/render-and-composite.sh:96

Shell command substitution

if ! node "$(dirname "$0")/check-timing.cjs" "$PROJECT" --strict; then

Mittel

scripts/render-and-composite.sh:112

Shell command substitution

node "$(dirname "$0")/check-occlusion.cjs" "$PROJECT" --strict > "$OCC_LOG" 2>&1 &

Mittel

scripts/render-and-composite.sh:146

Shell command substitution

if [[ ! -f "$PROJECT/plan.json" && -f "$PROJECT/index.html" && -f "$(dirname "$0")/check-overflow.cj

Mittel

scripts/render-and-composite.sh:147

Shell command substitution

node "$(dirname "$0")/check-overflow.cjs" "$PROJECT" \

Mittel

scripts/render-and-composite.sh:154

Shell command substitution

if [[ -f "$PROJECT/rail.html" && -f "$(dirname "$0")/check-overflow.cjs" ]]; then

Mittel

scripts/render-and-composite.sh:155

Shell command substitution

if node "$(dirname "$0")/check-overflow.cjs" "$PROJECT" rail.html; then

Mittel

scripts/render-and-composite.sh:167

Shell command substitution

if [[ -f "$PROJECT/rail.html" && -f "$PROJECT/index.html" && -f "$(dirname "$0")/check-rail-climax.c

Mittel

scripts/render-and-composite.sh:168

Shell command substitution

if ! node "$(dirname "$0")/check-rail-climax.cjs" "$PROJECT"; then

Mittel

scripts/render-and-composite.sh:187

Shell command substitution

FPS="$(tr -dc '0-9' < "$PROJECT/matte.fps")"

Mittel

Shell command substitution

PFPS="$(node -e 'try{process.stdout.write(String(require(process.argv[1]).fps??""))}catch(e){}' "$PR

Mittel

scripts/render-and-composite.sh:199

Shell command substitution

FPS="$(node -e 'process.stdout.write(String(require(process.argv[1]).fps??24))' "$PROJECT/plan.json"

Mittel

Shell command substitution

N="$(ls "$PROJECT/frames_fg" | wc -l | tr -d ' ')"

Mittel

scripts/render-and-composite.sh:200

Shell command substitution

DUR="$(grep -oE 'data-duration="[0-9.]+"' "$PROJECT/index.html" | head -1 | grep -oE '[0-9.]+' || ec

Mittel

scripts/render-and-composite.sh:202

Shell command substitution

FPS="$(awk "BEGIN{printf \"%d\", $N/$DUR + 0.5}")"

Mittel

scripts/render-and-composite.sh:220

Shell command substitution

CAPTION_LAYER="$(node -e 'process.stdout.write(String(require(process.argv[1]).caption_layer??"bg"))

Mittel

Shell command substitution

ATTR="$(grep -oE 'data-caption-layer="(bg|fg)"' "$PROJECT/index.html" | head -1 | grep -oE '(bg|fg)'

Mittel

scripts/render-and-composite.sh:233

Shell command substitution

STAMP="$(date +%Y%m%d-%H%M%S)"

Mittel

scripts/render-and-composite.sh:248

Shell command substitution

N_FRAMES="$(ls "$PROJECT/frames_fg" 2>/dev/null | wc -l | tr -d ' ')"

Mittel

scripts/render-and-composite.sh:249

Shell command substitution

HF_TIMEOUT_S="${HF_TIMEOUT_S:-$(( N_FRAMES * 3 / 2 > 240 ? N_FRAMES * 3 / 2 : 240 ))}"

Mittel

scripts/render-and-composite.sh:265

Shell command substitution

elapsed=$((SECONDS - start))

Mittel

scripts/render-and-composite.sh:268

Shell command substitution

[[ -f "$out" ]] && sz=$(stat -f%z "$out" 2>/dev/null || echo 0)

Mittel

scripts/render-and-composite.sh:295

Shell command substitution

b="$(basename "$p")"

Mittel

scripts/render-and-composite.sh:355

Shell command substitution

W="$(ffprobe -v error -select_streams v:0 -show_entries stream=width -of default=nw=1:nk=1 "$BG")"

Mittel

scripts/render-and-composite.sh:356

Shell command substitution

H="$(ffprobe -v error -select_streams v:0 -show_entries stream=height -of default=nw=1:nk=1 "$BG")"

Mittel

scripts/render-and-composite.sh:367

Shell command substitution

MATTE_DUR="$(awk "BEGIN{printf \"%.3f\", $(ls "$PROJECT/frames_fg" | wc -l)/$FPS}")"

Mittel

scripts/render-and-composite.sh:368

Shell command substitution

SRC_DUR="$(ffprobe -v error -show_entries format=duration -of csv=p=0 "$PROJECT/source.mp4" 2>/dev/n

Mittel

scripts/render-and-composite.sh:370

Shell command substitution

MATTE_DUR="$(awk "BEGIN{m=$MATTE_DUR; s=$SRC_DUR; printf \"%.3f\", (s>0 && s<m) ? s : m}")"

Mittel

scripts/render-and-composite.sh:381

Shell command substitution

BG_DUR="$(ffprobe -v error -show_entries format=duration -of default=nokey=1:noprint_wrappers=1 "$BG

Mittel

scripts/render-and-composite.sh:256-289

Template literal with command substitution

# bash 3.2 (macOS) throws on empty-array expansion under `set -u`, so branch

Mittel

scripts/safe-zones.cjs:41

Dynamic require with variable

sharp = require(c);

Mittel

Node.js fs operations

words = (JSON.parse(fs.readFileSync(tp, "utf8")).words || []).filter((w) => w && "start" in w);

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations

fs.writeFileSync(path.join(project, "safe-zones.json"), JSON.stringify(out, null, 2));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Synchronous file operations

words = (JSON.parse(fs.readFileSync(tp, "utf8")).words || []).filter((w) => w && "start" in w);

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Synchronous file operations

fs.writeFileSync(path.join(project, "safe-zones.json"), JSON.stringify(out, null, 2));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/transcribe.cjs:217

Node.js fs operations

const d = JSON.parse(fs.readFileSync(out, "utf8"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Node.js fs operations

const wxJson = JSON.parse(fs.readFileSync(path.join(outDir, "_wx_audio.json"), "utf8"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/transcribe.cjs:239

Node.js fs operations

fs.unlinkSync(wav);

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/transcribe.cjs:263

Node.js fs operations

const flat = JSON.parse(fs.readFileSync(flatPath, "utf8"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/transcribe.cjs:217

Synchronous file operations

const d = JSON.parse(fs.readFileSync(out, "utf8"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

Synchronous file operations

const wxJson = JSON.parse(fs.readFileSync(path.join(outDir, "_wx_audio.json"), "utf8"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Mittel

scripts/transcribe.cjs:263

Synchronous file operations

const flat = JSON.parse(fs.readFileSync(flatPath, "utf8"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

modes/cinematic/_archive/champion/template.html:26 modes/cinematic/_archive/memory-wall/template.html:29 modes/cinematic/_archive/portrait-header/template.html:18 modes/cinematic/cinematic-cream/template.html:87 modes/cinematic/engine.html:29 modes/standard/_anatomy.md:168 references/example-renders/champion.html:6 references/example-renders/memory-wall.html:6

Hardcoded URL · 8 Vorkommen

The template or generated HTML references a jsDelivr CDN URL for GSAP, which can cause outbound network requests during preview or render. The dependency should be bundled or pinned locally for marketplace use.

Niedrig

scripts/audio-envelope.cjs:30 scripts/check-rail-climax.cjs:40 scripts/make-composition.cjs:83 scripts/preview-frames.cjs:42

Node.js fs stat operations · 4 Vorkommen

if (fs.existsSync(p)) return p;

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/check-occlusion.cjs:22

Node.js fs stat operations

if (fs.existsSync(bun))

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/check-occlusion.cjs:40

Node.js fs stat operations

if (fs.existsSync(c)) return require(c);

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

Node.js fs stat operations

let stale = force || !fs.existsSync(lp);

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/check-occlusion.cjs:41

Node.js fs stat operations

if (!stale && fs.existsSync(idx) && fs.statSync(idx).mtimeMs > fs.statSync(lp).mtimeMs)

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/check-occlusion.cjs:50

Node.js fs stat operations

if (!fs.existsSync(png)) return null;

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/check-occlusion.cjs:93

Node.js fs stat operations

if (!fs.existsSync(framesDir)) {

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/check-occlusion.cjs:14 scripts/check-overflow.cjs:21 scripts/check-rail-climax.cjs:23 scripts/matte.cjs:35 scripts/measure-layout.cjs:25 scripts/preview-frames.cjs:28 scripts/safe-zones.cjs:25 scripts/transcribe.cjs:17

Node.js fs stat operations

const plan = fs.existsSync(planPath) ? JSON.parse(fs.readFileSync(planPath, "utf8")) : {};

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

Environment variable access (dot notation) · 8 Vorkommen

process.env.HYPERFRAMES_ROOT,

The script reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose tool paths, engines, or package versions. No exfiltration is evident, but environment-controlled execution is a real configuration risk.

Niedrig

Environment variable object · 8 Vorkommen

process.env.HYPERFRAMES_ROOT,

Niedrig

scripts/check-overflow.cjs:30 scripts/measure-layout.cjs:34 scripts/measure-layout.cjs:74

Node.js fs stat operations · 3 Vorkommen

if (fs.existsSync(bunDir)) {

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/check-overflow.cjs:40 scripts/measure-layout.cjs:45 scripts/measure-layout.cjs:85

Node.js fs stat operations · 3 Vorkommen

if (fs.existsSync(p)) {

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/check-overflow.cjs:57 scripts/measure-layout.cjs:103

Node.js fs stat operations · 2 Vorkommen

if (!fs.existsSync(indexPath)) {

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/check-overflow.cjs:77 scripts/check-rail-climax.cjs:167 scripts/measure-layout.cjs:139 scripts/preview-frames.cjs:208

Node.js fs stat operations · 4 Vorkommen

executablePath: fs.existsSync(exe) ? exe : undefined,

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/check-rail-climax.cjs:32 scripts/preview-frames.cjs:36 scripts/safe-zones.cjs:34

Node.js fs stat operations · 3 Vorkommen

if (fs.existsSync(bunDir))

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/check-rail-climax.cjs:155

Node.js fs stat operations

if (!fs.existsSync(railPath) || !fs.existsSync(indexPath))

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/lib-dna.cjs:39

Node.js fs stat operations

if (!fs.existsSync(p)) {

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/make-cinematic.cjs:74

Node.js fs stat operations

if (!fs.existsSync(cj)) die(`missing ${cj} — author it first (schema in this header)`);

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/make-cinematic.cjs:75

Node.js fs stat operations

if (!fs.existsSync(tj)) die(`missing ${tj} — run prepare.sh first`);

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/make-cinematic.cjs:177

Node.js fs stat operations

if (!fs.existsSync(fp)) continue;

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/make-composition.cjs:41

Node.js fs stat operations

if (!fs.existsSync(p)) continue;

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/make-composition.cjs:86

Node.js fs stat operations

.filter((d) => fs.existsSync(path.join(TEMPLATES, d, "template.html")))

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/make-composition.cjs:242

Node.js fs stat operations

if (!fs.existsSync(planPath)) {

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/make-theme.cjs:8731

Hardcoded URL

const GSAP = `<script src="https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js" integrity="sha

Niedrig

Node.js fs stat operations

} else if (fs.existsSync(path.join(PROJECT, "rail.html"))) {

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/matte.cjs:41

Node.js fs stat operations

if (fs.existsSync(cli)) return cli;

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/matte.cjs:49 scripts/matte.cjs:137 scripts/transcribe.cjs:151

Node.js fs stat operations · 3 Vorkommen

if (!fs.existsSync(src)) {

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/matte.cjs:172

Node.js fs stat operations

if (!fs.existsSync(cfr)) {

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/matte.cjs:202

Node.js fs stat operations

const cached = fs.existsSync(

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/matte.cjs:219

Node.js fs stat operations

if (r.status !== 0 || !fs.existsSync(mov)) {

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/measure-layout.cjs:187 scripts/preview-frames.cjs:105

Node.js fs stat operations

if (fs.existsSync(planPath)) plan = JSON.parse(fs.readFileSync(planPath, "utf8"));

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

Node.js fs stat operations · 2 Vorkommen

if (fs.existsSync(fontsCss))

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/preview-frames.cjs:135

Node.js fs stat operations

if (!fs.existsSync(idx)) {

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/preview-frames.cjs:140

Node.js fs stat operations

const hasRail = fs.existsSync(railP);

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/preview-frames.cjs:142

Node.js fs stat operations

const hasFg = fs.existsSync(fgP); // hybrid: fg caps render ABOVE the matte (like the real composite

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/preview-frames.cjs:179

Node.js fs stat operations

const n = fs.existsSync(path.join(project, "frames_bg"))

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/preview-frames.cjs:217

Node.js fs stat operations

if (!fs.existsSync(bg)) {

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/preview-frames.cjs:224

Node.js fs stat operations

if (!globalFg && fs.existsSync(fg)) layers.push({ input: fg }); // subject occludes embed

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/safe-zones.cjs:40

Node.js fs stat operations

if (fs.existsSync(c)) {

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/safe-zones.cjs:521

Node.js fs stat operations

if (!fs.existsSync(tp)) return [];

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/safe-zones.cjs:556

Node.js fs stat operations

if (!fs.existsSync(fgDir)) {

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/safe-zones.cjs:588

Node.js fs stat operations

const hasBg = fs.existsSync(bgDir);

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/safe-zones.cjs:608

Node.js fs stat operations

if (hasBg && fs.existsSync(path.join(bgDir, frames[i]))) {

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/safe-zones.cjs:706

Node.js fs stat operations

if (hasBg && fs.existsSync(midBg)) {

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/transcribe.cjs:22

Node.js fs stat operations

if (fs.existsSync(path.join(r, "packages", "cli", "dist", "cli.js"))) return r;

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/transcribe.cjs:28

Node.js fs stat operations

if (fs.existsSync(src)) return src;

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/transcribe.cjs:39

Node.js fs stat operations

let found = cands.sort((a, b) => fs.statSync(b).size - fs.statSync(a).size)[0];

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

scripts/transcribe.cjs:156

Node.js fs stat operations

if (!fs.existsSync(audio))

The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.

Niedrig

Environment variable access (dot notation)

const model = process.argv[3] || process.env.WHISPER_MODEL || "small";

Niedrig

Environment variable access (dot notation)

const language = process.argv[4] || process.env.WHISPER_LANG || "";

Niedrig

scripts/transcribe.cjs:181

Environment variable access (dot notation)

const wantWx = (process.env.TRANSCRIBE_ENGINE || "whisperx") === "whisperx";

Niedrig

Environment variable access (dot notation)

const whisperxSpec = `whisperx==${process.env.WHISPERX_VERSION || "3.8.6"}`;

Niedrig

Environment variable object

const model = process.argv[3] || process.env.WHISPER_MODEL || "small";

Niedrig

Environment variable object

const language = process.argv[4] || process.env.WHISPER_LANG || "";

Niedrig

scripts/transcribe.cjs:181

Environment variable object

const wantWx = (process.env.TRANSCRIBE_ENGINE || "whisperx") === "whisperx";

Niedrig

Environment variable object

const whisperxSpec = `whisperx==${process.env.WHISPERX_VERSION || "3.8.6"}`;

Risikofaktoren

🌐 Netzwerkzugriff (11)

📁 Dateisystemzugriff (321)

⚙️ Externe Befehle (800)

⚡ Enthält Skripte (12)

🔑 Umgebungsvariablen (24)

Geprüft von: codex

Audit-Version 3

5. Juli 2026, 15:34

The skill is a legitimate but high-risk local video rendering pipeline. Many static critical detections are false positives from visual theme names and documentation syntax, but the skill still performs real child-process execution, filesystem writes, symlink creation, CDN script loading, and runtime dependency downloads.

Gescannte Dateien

25,422

Analysierte Zeilen

374

Prüfelemente

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (3)

Hoch

SKILL.md:120

Unpinned Global Skill Auto-Update

The instructions state that initialization checks installed skills against GitHub and updates the global set when out of date. This can change globally installed skill behavior during a caption setup step.

The behavior is explicitly documented on line 120. I did not verify the external CLI implementation, so confidence is high but not absolute.

Hoch

SKILL.md:280 SKILL.md:284

Runtime Download and Execution Supply Chain

The skill relies on uvx WhisperX and hyperframes model downloads during normal operation. This executes or stores third-party code and model artifacts outside the project directory.

The dependency and model download behavior is stated directly in the dependency section. The static findings also show matching child_process and hidden-cache usage.

Niedrig

scripts/audio-envelope.cjs:15 scripts/check-occlusion.cjs:10 scripts/make-cinematic.cjs:172 scripts/make-composition.cjs:18 scripts/matte.cjs:31 scripts/transcribe.cjs:13

Unscanned file (too_large) — manual review required

[unscanned: too_large]

This binary or oversized asset was not statically inspected. It appears to be a font asset, but marketplace review should verify provenance before publication.

Elemente der Fähigkeitsprüfung (366)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Hoch

Node.js child_process module · 6 Vorkommen

const cp = require("child_process");

The script imports child_process and the skill pipeline uses it to run ffmpeg, node, uvx, python, or hyperframes tools. That is real local command execution capability.

Hoch

scripts/audio-envelope.cjs:54

Synchronous file execution

out = cp.execFileSync(

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

scripts/check-occlusion.cjs:44

Synchronous file execution

cp.execFileSync("node", [path.join(__dirname, "measure-layout.cjs"), project], {

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

scripts/make-cinematic.cjs:715

Node.js child_process module

const cp2 = require("child_process");

The script imports child_process and the skill pipeline uses it to run ffmpeg, node, uvx, python, or hyperframes tools. That is real local command execution capability.

Hoch

scripts/make-cinematic.cjs:179 scripts/matte.cjs:114 scripts/matte.cjs:176 scripts/matte.cjs:227 scripts/transcribe.cjs:157

Node.js child_process module

require("child_process").spawnSync(

The script imports child_process and the skill pipeline uses it to run ffmpeg, node, uvx, python, or hyperframes tools. That is real local command execution capability.

Hoch

Synchronous file execution · 5 Vorkommen

cp.execFileSync(

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

scripts/make-cinematic.cjs:716

Synchronous spawn

let r = cp2.spawnSync("node", [path.join(__dirname, "make-composition.cjs"), project], {

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

scripts/make-cinematic.cjs:756 scripts/make-cinematic.cjs:925

Synchronous spawn · 2 Vorkommen

cp2.spawnSync(

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

scripts/make-cinematic.cjs:798 scripts/make-cinematic.cjs:1198

Synchronous spawn · 2 Vorkommen

cp2.spawnSync("node", [path.join(__dirname, "make-composition.cjs"), project], {

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

scripts/make-cinematic.cjs:1147

Synchronous spawn

require("child_process").spawnSync(

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

Synchronous spawn

r = cp2.spawnSync("node", [path.join(__dirname, "make-composition.cjs"), project], {

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

scripts/make-cinematic.cjs:1163

Synchronous spawn

cp2.spawnSync("node", [path.join(__dirname, "measure-layout.cjs"), project, String(midT)], {

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

scripts/make-composition.cjs:44

Synchronous file execution

.execFileSync(

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

scripts/make-theme.cjs:39

Node.js child_process module

const { execFileSync } = require("child_process");

The script imports child_process and the skill pipeline uses it to run ffmpeg, node, uvx, python, or hyperframes tools. That is real local command execution capability.

Hoch

scripts/make-theme.cjs:70

Synchronous file execution

const out = execFileSync(

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

scripts/make-theme.cjs:1284 scripts/make-theme.cjs:7013 scripts/make-theme.cjs:7183

Synchronous file execution · 3 Vorkommen

const D = execFileSync(

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

scripts/make-theme.cjs:7676 scripts/make-theme.cjs:7903 scripts/make-theme.cjs:8112

Synchronous file execution · 3 Vorkommen

let D = execFileSync(

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

scripts/matte.cjs:77

Synchronous file execution

.execFileSync("ffprobe", [

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

scripts/matte.cjs:215

Synchronous spawn

const r = cp.spawnSync("node", [hfCli(), "remove-background", matteSrc, "-o", mov], {

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

Hidden file in home directory

* weights — the model auto-downloads once (~168 MB) to ~/.cache/hyperframes/.

The skill documents downloads or cache writes under hidden home directories such as ~/.cache/hyperframes. Persistent hidden cache writes require user awareness and provenance checks.

Hoch

scripts/render-and-composite.sh:299

Symlink creation · 2 Vorkommen

fs.symlinkSync(path.basename(found), src);

The skill creates symlinks for source media or shadow render assets. Symlink creation can expose or overwrite unexpected paths if project directories are untrusted.

Hoch

Symlink creation

ln -sf "$p" "$sh/$b"

The skill creates symlinks for source media or shadow render assets. Symlink creation can expose or overwrite unexpected paths if project directories are untrusted.

Hoch

scripts/transcribe.cjs:172

Synchronous file execution

cp.execFileSync("ffmpeg", ["-y", "-i", src, "-vn", "-ac", "1", "-ar", "16000", wav], {

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

scripts/transcribe.cjs:251

Synchronous file execution

const so = cp.execFileSync("node", [cli, ...args], { encoding: "utf8" });

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

scripts/transcribe.cjs:57 scripts/transcribe.cjs:77

Synchronous spawn · 2 Vorkommen

const r = cp.spawnSync(

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

scripts/transcribe.cjs:201

Synchronous spawn

let r = cp.spawnSync("uvx", wxArgs, { encoding: "utf8", timeout: 600000 });

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

scripts/transcribe.cjs:203

Synchronous spawn

r = cp.spawnSync(

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

Hidden file in home directory

- **Node-first; two Python touchpoints via `uvx` (no manual installs):** transcription runs WhisperX

The skill documents downloads or cache writes under hidden home directories such as ~/.cache/hyperframes. Persistent hidden cache writes require user awareness and provenance checks.

Hoch

modes/standard/_anatomy.md:179

Hidden file in home directory

- Matting weights are NOT bundled: `matte.cjs` shells the hyperframes CLI's `remove-background`, whi

The skill documents downloads or cache writes under hidden home directories such as ~/.cache/hyperframes. Persistent hidden cache writes require user awareness and provenance checks.

Mittel

innerHTML assignment (XSS risk)

flow.innerHTML = line.words

The example inserts caption words into innerHTML, which would be unsafe if copied with transcript text that contains markup. The location is documentation, so confidence is moderate.

Mittel

Node.js fs operations

const buf = fs.readFileSync(path.join(FILES, f));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

fs.writeFileSync(OUT, header + "\n" + faces.join("\n\n") + "\n");

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

const buf = fs.readFileSync(path.join(FILES, f));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

references/test-set.md:27

Synchronous file operations

fs.writeFileSync(OUT, header + "\n" + faces.join("\n\n") + "\n");

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Temp directory access

bash scripts/render-and-composite.sh /tmp/ts-${case}

The documented test command writes projects under /tmp, which is normal for tests but still uses shared temporary filesystem space.

Mittel

Node.js fs operations

fs.writeFileSync(path.join(project, "envelope.json"), JSON.stringify({ hop: HOP, rms }));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

fs.writeFileSync(path.join(project, "envelope.json"), JSON.stringify({ hop: HOP, rms }));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/check-occlusion.cjs:23

Dynamic require with variable

if (fs.existsSync(c)) return require(c);

The skill resolves dependencies or JSON inputs dynamically instead of using a pinned import path. This is intended tooling, but it can load code or data from mutable local locations.

Mittel

Node.js fs operations

for (const d of fs.readdirSync(bun))

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

return JSON.parse(fs.readFileSync(lp, "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

const plan = fs.existsSync(planPath) ? JSON.parse(fs.readFileSync(planPath, "utf8")) : {};

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

return JSON.parse(fs.readFileSync(lp, "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/check-overflow.cjs:41 scripts/check-rail-climax.cjs:52 scripts/measure-layout.cjs:46 scripts/preview-frames.cjs:54

Synchronous file operations

const plan = fs.existsSync(planPath) ? JSON.parse(fs.readFileSync(planPath, "utf8")) : {};

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Dynamic require with variable · 4 Vorkommen

puppeteer = require(p);

The skill resolves dependencies or JSON inputs dynamically instead of using a pinned import path. This is intended tooling, but it can load code or data from mutable local locations.

Mittel

scripts/check-overflow.cjs:31 scripts/check-rail-climax.cjs:33 scripts/preview-frames.cjs:37 scripts/safe-zones.cjs:35

Node.js fs operations · 4 Vorkommen

for (const d of fs.readdirSync(bunDir))

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

const html = fs.readFileSync(indexPath, "utf8");

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/check-rail-climax.cjs:58 scripts/preview-frames.cjs:66

Synchronous file operations

const html = fs.readFileSync(indexPath, "utf8");

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations · 2 Vorkommen

if (g) gsapSource = fs.readFileSync(g, "utf8");

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/check-rail-climax.cjs:58 scripts/preview-frames.cjs:66

Synchronous file operations · 2 Vorkommen

if (g) gsapSource = fs.readFileSync(g, "utf8");

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/check-timing.cjs:55 scripts/preview-frames.cjs:161

Node.js fs operations · 2 Vorkommen

const plan = JSON.parse(fs.readFileSync(path.join(project, "plan.json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/check-timing.cjs:55 scripts/preview-frames.cjs:161

Node.js fs operations

const t = JSON.parse(fs.readFileSync(path.join(project, "transcript.json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations · 2 Vorkommen

const plan = JSON.parse(fs.readFileSync(path.join(project, "plan.json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/fill-timings.cjs:73 scripts/fit-fonts.cjs:95

Synchronous file operations

const t = JSON.parse(fs.readFileSync(path.join(project, "transcript.json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations · 2 Vorkommen

plan = JSON.parse(fs.readFileSync(planPath, "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/fill-timings.cjs:113 scripts/fit-fonts.cjs:154

Node.js fs operations

trWordsRaw = JSON.parse(fs.readFileSync(trPath, "utf8")).words || [];

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations · 2 Vorkommen

fs.writeFileSync(planPath, JSON.stringify(plan, null, 2));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/fill-timings.cjs:73 scripts/fit-fonts.cjs:95

Synchronous file operations · 2 Vorkommen

plan = JSON.parse(fs.readFileSync(planPath, "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/fill-timings.cjs:113 scripts/fit-fonts.cjs:154

Synchronous file operations

trWordsRaw = JSON.parse(fs.readFileSync(trPath, "utf8")).words || [];

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations · 2 Vorkommen

fs.writeFileSync(planPath, JSON.stringify(plan, null, 2));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

css = fs.readFileSync(FONTS_CSS, "utf8");

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/inject-fonts.cjs:131 scripts/inject-fonts.cjs:142

Node.js fs operations

html = fs.readFileSync(file, "utf8");

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations · 2 Vorkommen

fs.writeFileSync(file, html);

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

css = fs.readFileSync(FONTS_CSS, "utf8");

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/inject-fonts.cjs:131 scripts/inject-fonts.cjs:142

Synchronous file operations

html = fs.readFileSync(file, "utf8");

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations · 2 Vorkommen

fs.writeFileSync(file, html);

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/lib-dna.cjs:42 scripts/lib-dna.cjs:47 scripts/make-theme.cjs:98

Node.js fs operations · 3 Vorkommen

return JSON.parse(fs.readFileSync(p, "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/lib-dna.cjs:42 scripts/lib-dna.cjs:47 scripts/make-theme.cjs:98

Synchronous file operations · 3 Vorkommen

return JSON.parse(fs.readFileSync(p, "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

const C = JSON.parse(fs.readFileSync(cj, "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

const tr = (JSON.parse(fs.readFileSync(tj, "utf8")).words || []).filter(

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/make-cinematic.cjs:174

Node.js fs operations

sz = JSON.parse(fs.readFileSync(path.join(project, "safe-zones.json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

fs.readdirSync(project).filter((x) => /\.(mp4|mov|webm)$/i.test(x)),

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/make-cinematic.cjs:708 scripts/make-cinematic.cjs:797 scripts/make-cinematic.cjs:859 scripts/make-cinematic.cjs:1146 scripts/make-cinematic.cjs:1197

Node.js fs operations · 5 Vorkommen

fs.writeFileSync(path.join(project, "plan.json"), JSON.stringify(plan, null, 2));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/make-cinematic.cjs:802 scripts/make-cinematic.cjs:1151 scripts/make-cinematic.cjs:1193

Node.js fs operations

lay = JSON.parse(fs.readFileSync(path.join(project, "_layout.json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations · 3 Vorkommen

fs.unlinkSync(path.join(project, "_layout.json"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

const ss = JSON.parse(fs.readFileSync(path.join(project, "_layout.json"), "utf8")).samples;

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

JSON.parse(fs.readFileSync(path.join(project, "_layout.json"), "utf8")).samples[0].caps ||

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

const C = JSON.parse(fs.readFileSync(cj, "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

const tr = (JSON.parse(fs.readFileSync(tj, "utf8")).words || []).filter(

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/make-cinematic.cjs:708 scripts/make-cinematic.cjs:797 scripts/make-cinematic.cjs:859 scripts/make-cinematic.cjs:1146 scripts/make-cinematic.cjs:1197

Synchronous file operations

sz = JSON.parse(fs.readFileSync(path.join(project, "safe-zones.json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations · 5 Vorkommen

fs.writeFileSync(path.join(project, "plan.json"), JSON.stringify(plan, null, 2));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

lay = JSON.parse(fs.readFileSync(path.join(project, "_layout.json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

const ss = JSON.parse(fs.readFileSync(path.join(project, "_layout.json"), "utf8")).samples;

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

JSON.parse(fs.readFileSync(path.join(project, "_layout.json"), "utf8")).samples[0].caps ||

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

const plan = JSON.parse(fs.readFileSync(planPath, "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

? fs.readFileSync(path.join(TEMPLATES, "engine.html"), "utf8")

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

: fs.readFileSync(findTemplate(plan.template), "utf8");

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

fs.writeFileSync(path.join(project, "index.html"), src);

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

fs.writeFileSync(path.join(project, "index_fg.html"), fg);

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

const plan = JSON.parse(fs.readFileSync(planPath, "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

? fs.readFileSync(path.join(TEMPLATES, "engine.html"), "utf8")

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

: fs.readFileSync(findTemplate(plan.template), "utf8");

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

fs.writeFileSync(path.join(project, "index.html"), src);

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/make-theme.cjs:8766

Synchronous file operations

fs.writeFileSync(path.join(project, "index_fg.html"), fg);

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Shell command substitution

cd "$(dirname "$0")"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/make-theme.cjs:8763-8773

Template literal with command substitution

`#!/usr/bin/env bash

The compiler writes a shell script containing command substitution into the project. This is expected post-processing behavior, but it expands the local command-execution surface.

Mittel

Node.js fs operations

const theme = JSON.parse(fs.readFileSync(path.join(PROJECT, "theme.json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

const dna = JSON.parse(fs.readFileSync(path.join(SKILL, "themes", theme.dna + ".json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

const transcript = JSON.parse(fs.readFileSync(path.join(PROJECT, "transcript.json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/make-theme.cjs:85

Node.js fs operations

fs.readFileSync(path.join(PROJECT, "matte.fps"), "utf8").replace(/\D/g, ""),

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

const n = fs.readdirSync(path.join(PROJECT, "frames_fg")).length;

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/make-theme.cjs:517 scripts/make-theme.cjs:5138

Node.js fs operations

return JSON.parse(fs.readFileSync(path.join(SKILL, "assets/fonts/char-widths.json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations · 2 Vorkommen

fs.readFileSync(path.join(SKILL, "assets/brand/cyberpunk-widths.json"), "utf8"),

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

css = fs.readFileSync(path.join(SKILL, "modes/standard/fonts/fonts.css"), "utf8");

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

fs.writeFileSync(path.join(PROJECT, "index.html"), bgHtml);

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/make-theme.cjs:8732

Node.js fs operations

fs.writeFileSync(path.join(PROJECT, "rail.html"), fgHtml);

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

fs.unlinkSync(path.join(PROJECT, "rail.html"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/make-theme.cjs:8761 scripts/transcribe.cjs:294

Node.js fs operations · 2 Vorkommen

fs.writeFileSync(

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

const theme = JSON.parse(fs.readFileSync(path.join(PROJECT, "theme.json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

const dna = JSON.parse(fs.readFileSync(path.join(SKILL, "themes", theme.dna + ".json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

const transcript = JSON.parse(fs.readFileSync(path.join(PROJECT, "transcript.json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

fs.readFileSync(path.join(PROJECT, "matte.fps"), "utf8").replace(/\D/g, ""),

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/make-theme.cjs:517 scripts/make-theme.cjs:5138

Synchronous file operations

return JSON.parse(fs.readFileSync(path.join(SKILL, "assets/fonts/char-widths.json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations · 2 Vorkommen

fs.readFileSync(path.join(SKILL, "assets/brand/cyberpunk-widths.json"), "utf8"),

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/make-theme.cjs:5141

Synchronous file operations

css = fs.readFileSync(path.join(SKILL, "modes/standard/fonts/fonts.css"), "utf8");

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

.readFileSync(path.join(SKILL, "assets/brand/CyberpunkReplica.ttf"))

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

fs.writeFileSync(path.join(PROJECT, "index.html"), bgHtml);

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/make-theme.cjs:8761 scripts/transcribe.cjs:294

Synchronous file operations

fs.writeFileSync(path.join(PROJECT, "rail.html"), fgHtml);

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations · 2 Vorkommen

fs.writeFileSync(

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/matte.cjs:58 scripts/transcribe.cjs:44

Node.js fs operations · 2 Vorkommen

fs.symlinkSync(path.basename(found), src);

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations · 2 Vorkommen

fs.copyFileSync(found, src);

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/matte.cjs:112

Node.js fs operations

fs.mkdirSync(dst, { recursive: true });

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/matte.cjs:113

Node.js fs operations

if (fs.readdirSync(dst).some((f) => f.endsWith(".png"))) return false;

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/matte.cjs:124

Node.js fs operations

return fs.readdirSync(dir).filter((f) => f.endsWith(".png")).length;

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

fps = parseInt(fs.readFileSync(fpsFile, "utf8").replace(/\D/g, ""), 10) || 0;

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/matte.cjs:255 scripts/matte.cjs:265

Node.js fs operations

fs.writeFileSync(fpsFile, String(fps));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/matte.cjs:226

Node.js fs operations

fs.mkdirSync(framesFg, { recursive: true });

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/matte.cjs:232

Node.js fs operations

fs.rmSync(mov, { force: true });

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/matte.cjs:253

Node.js fs operations

fs.mkdirSync(tmp, { recursive: true });

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations · 2 Vorkommen

fs.copyFileSync(

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/matte.cjs:260

Node.js fs operations

fs.rmSync(framesFg, { recursive: true, force: true });

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/matte.cjs:261

Node.js fs operations

fs.renameSync(tmp, framesFg);

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

fps = parseInt(fs.readFileSync(fpsFile, "utf8").replace(/\D/g, ""), 10) || 0;

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

fs.writeFileSync(fpsFile, String(fps));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/measure-layout.cjs:35 scripts/measure-layout.cjs:75

Hidden file access

* weights — the model auto-downloads once (~168 MB) to ~/.cache/hyperframes/.

The referenced dependency cache lives under a hidden home directory. This is expected for model tooling but creates persistent local state outside the project.

Mittel

Node.js fs operations · 2 Vorkommen

for (const d of fs.readdirSync(bunDir)) {

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

gsapSource = fs.readFileSync(p, "utf8");

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/measure-layout.cjs:188 scripts/preview-frames.cjs:106

Node.js fs operations

if (fs.existsSync(planPath)) plan = JSON.parse(fs.readFileSync(planPath, "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations · 2 Vorkommen

await page.addStyleTag({ content: fs.readFileSync(fontsCss, "utf8") });

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

fs.writeFileSync(outPath, JSON.stringify(layout, null, 2));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

gsapSource = fs.readFileSync(p, "utf8");

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/measure-layout.cjs:188 scripts/preview-frames.cjs:106

Synchronous file operations

if (fs.existsSync(planPath)) plan = JSON.parse(fs.readFileSync(planPath, "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations · 2 Vorkommen

await page.addStyleTag({ content: fs.readFileSync(fontsCss, "utf8") });

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/prepare.sh:17 scripts/render-and-composite.sh:13 scripts/render-theme.sh:8

Synchronous file operations

fs.writeFileSync(outPath, JSON.stringify(layout, null, 2));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Shell command substitution · 3 Vorkommen

PROJECT="$(cd "$PROJECT" && pwd)"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/prepare.sh:18 scripts/render-theme.sh:9

Shell command substitution · 2 Vorkommen

SD="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/preview-frames.cjs:61

Dynamic require with variable

sharp = require(p);

The skill resolves dependencies or JSON inputs dynamically instead of using a pinned import path. This is intended tooling, but it can load code or data from mutable local locations.

Mittel

scripts/preview-frames.cjs:147 scripts/safe-zones.cjs:582

Node.js fs operations · 2 Vorkommen

String(fs.readFileSync(path.join(project, "matte.fps"), "utf8")).replace(/[^\d.]/g, ""),

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/preview-frames.cjs:180

Node.js fs operations

JSON.parse(fs.readFileSync(path.join(project, "plan.json"), "utf8")).caption_layer === "fg";

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

? fs.readdirSync(path.join(project, "frames_bg")).length

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/preview-frames.cjs:200 scripts/transcribe.cjs:176

Node.js fs operations · 2 Vorkommen

fs.mkdirSync(outDir, { recursive: true });

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/preview-frames.cjs:147 scripts/safe-zones.cjs:582

Synchronous file operations · 2 Vorkommen

String(fs.readFileSync(path.join(project, "matte.fps"), "utf8")).replace(/[^\d.]/g, ""),

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

JSON.parse(fs.readFileSync(path.join(project, "plan.json"), "utf8")).caption_layer === "fg";

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Dynamic require with variable

PFPS="$(node -e 'try{process.stdout.write(String(require(process.argv[1]).fps??""))}catch(e){}' "$PR

The skill resolves dependencies or JSON inputs dynamically instead of using a pinned import path. This is intended tooling, but it can load code or data from mutable local locations.

Mittel

Dynamic require with variable

FPS="$(node -e 'process.stdout.write(String(require(process.argv[1]).fps??24))' "$PROJECT/plan.json"

The skill resolves dependencies or JSON inputs dynamically instead of using a pinned import path. This is intended tooling, but it can load code or data from mutable local locations.

Mittel

scripts/render-and-composite.sh:18

Dynamic require with variable

CAPTION_LAYER="$(node -e 'process.stdout.write(String(require(process.argv[1]).caption_layer??"bg"))

The skill resolves dependencies or JSON inputs dynamically instead of using a pinned import path. This is intended tooling, but it can load code or data from mutable local locations.

Mittel

Shell command substitution

SKILL_SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:20

Shell command substitution

for cand in "${2:-}" "${HYPERFRAMES_ROOT:-}" "$(cd "$SKILL_SCRIPT_DIR/../../.." 2>/dev/null && pwd)"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:43 scripts/render-and-composite.sh:58 scripts/render-and-composite.sh:64

Shell command substitution · 3 Vorkommen

C="$(compiler_for)"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:45 scripts/render-and-composite.sh:60

Shell command substitution · 2 Vorkommen

node "$(dirname "$0")/$C" "$PROJECT"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:49 scripts/render-and-composite.sh:56

Shell command substitution · 2 Vorkommen

node "$(dirname "$0")/make-cinematic.cjs" "$PROJECT"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:69

Shell command substitution

ENGINE="$(dirname "$0")/../modes/cinematic/engine.html"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:70

Shell command substitution

if [[ "$(dirname "$0")/$RECOMPILER" -nt "$PROJECT/index.html" || "$(dirname "$0")/lib-dna.cjs" -nt "

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:72

Shell command substitution

node "$(dirname "$0")/$RECOMPILER" "$PROJECT"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:84

Shell command substitution

node "$(dirname "$0")/inject-fonts.cjs" "$PROJECT" \

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:96

Shell command substitution

if ! node "$(dirname "$0")/check-timing.cjs" "$PROJECT" --strict; then

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:112

Shell command substitution

node "$(dirname "$0")/check-occlusion.cjs" "$PROJECT" --strict > "$OCC_LOG" 2>&1 &

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:146

Shell command substitution

if [[ ! -f "$PROJECT/plan.json" && -f "$PROJECT/index.html" && -f "$(dirname "$0")/check-overflow.cj

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:147

Shell command substitution

node "$(dirname "$0")/check-overflow.cjs" "$PROJECT" \

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:154

Shell command substitution

if [[ -f "$PROJECT/rail.html" && -f "$(dirname "$0")/check-overflow.cjs" ]]; then

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:155

Shell command substitution

if node "$(dirname "$0")/check-overflow.cjs" "$PROJECT" rail.html; then

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:167

Shell command substitution

if [[ -f "$PROJECT/rail.html" && -f "$PROJECT/index.html" && -f "$(dirname "$0")/check-rail-climax.c

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:168

Shell command substitution

if ! node "$(dirname "$0")/check-rail-climax.cjs" "$PROJECT"; then

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:187

Shell command substitution

FPS="$(tr -dc '0-9' < "$PROJECT/matte.fps")"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

Shell command substitution

PFPS="$(node -e 'try{process.stdout.write(String(require(process.argv[1]).fps??""))}catch(e){}' "$PR

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:199

Shell command substitution

FPS="$(node -e 'process.stdout.write(String(require(process.argv[1]).fps??24))' "$PROJECT/plan.json"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

Shell command substitution

N="$(ls "$PROJECT/frames_fg" | wc -l | tr -d ' ')"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:200

Shell command substitution

DUR="$(grep -oE 'data-duration="[0-9.]+"' "$PROJECT/index.html" | head -1 | grep -oE '[0-9.]+' || ec

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:202

Shell command substitution

FPS="$(awk "BEGIN{printf \"%d\", $N/$DUR + 0.5}")"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:220

Shell command substitution

CAPTION_LAYER="$(node -e 'process.stdout.write(String(require(process.argv[1]).caption_layer??"bg"))

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

Shell command substitution

ATTR="$(grep -oE 'data-caption-layer="(bg|fg)"' "$PROJECT/index.html" | head -1 | grep -oE '(bg|fg)'

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:233

Shell command substitution

STAMP="$(date +%Y%m%d-%H%M%S)"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:248

Shell command substitution

N_FRAMES="$(ls "$PROJECT/frames_fg" 2>/dev/null | wc -l | tr -d ' ')"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:249

Shell command substitution

HF_TIMEOUT_S="${HF_TIMEOUT_S:-$(( N_FRAMES * 3 / 2 > 240 ? N_FRAMES * 3 / 2 : 240 ))}"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:265

Shell command substitution

elapsed=$((SECONDS - start))

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:268

Shell command substitution

[[ -f "$out" ]] && sz=$(stat -f%z "$out" 2>/dev/null || echo 0)

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:295

Shell command substitution

b="$(basename "$p")"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:355

Shell command substitution

W="$(ffprobe -v error -select_streams v:0 -show_entries stream=width -of default=nw=1:nk=1 "$BG")"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:356

Shell command substitution

H="$(ffprobe -v error -select_streams v:0 -show_entries stream=height -of default=nw=1:nk=1 "$BG")"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:367

Shell command substitution

MATTE_DUR="$(awk "BEGIN{printf \"%.3f\", $(ls "$PROJECT/frames_fg" | wc -l)/$FPS}")"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:368

Shell command substitution

SRC_DUR="$(ffprobe -v error -show_entries format=duration -of csv=p=0 "$PROJECT/source.mp4" 2>/dev/n

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:370

Shell command substitution

MATTE_DUR="$(awk "BEGIN{m=$MATTE_DUR; s=$SRC_DUR; printf \"%.3f\", (s>0 && s<m) ? s : m}")"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:381

Shell command substitution

BG_DUR="$(ffprobe -v error -show_entries format=duration -of default=nokey=1:noprint_wrappers=1 "$BG

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/safe-zones.cjs:41

Dynamic require with variable

sharp = require(c);

The skill resolves dependencies or JSON inputs dynamically instead of using a pinned import path. This is intended tooling, but it can load code or data from mutable local locations.

Mittel

Node.js fs operations

words = (JSON.parse(fs.readFileSync(tp, "utf8")).words || []).filter((w) => w && "start" in w);

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

fs.writeFileSync(path.join(project, "safe-zones.json"), JSON.stringify(out, null, 2));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

words = (JSON.parse(fs.readFileSync(tp, "utf8")).words || []).filter((w) => w && "start" in w);

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

fs.writeFileSync(path.join(project, "safe-zones.json"), JSON.stringify(out, null, 2));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

const d = JSON.parse(fs.readFileSync(out, "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/transcribe.cjs:235

Node.js fs operations

const wxJson = JSON.parse(fs.readFileSync(path.join(outDir, "_wx_audio.json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

fs.unlinkSync(wav);

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

const flat = JSON.parse(fs.readFileSync(flatPath, "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

const d = JSON.parse(fs.readFileSync(out, "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

const wxJson = JSON.parse(fs.readFileSync(path.join(outDir, "_wx_audio.json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

const flat = JSON.parse(fs.readFileSync(flatPath, "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Hidden file access

- **Node-first; two Python touchpoints via `uvx` (no manual installs):** transcription runs WhisperX

The referenced dependency cache lives under a hidden home directory. This is expected for model tooling but creates persistent local state outside the project.

Mittel

modes/cinematic/_archive/champion/template.html:26 modes/cinematic/_archive/memory-wall/template.html:29 modes/cinematic/_archive/portrait-header/template.html:18 modes/cinematic/cinematic-cream/template.html:87 modes/cinematic/engine.html:29 modes/standard/_anatomy.md:168 references/example-renders/champion.html:6 references/example-renders/memory-wall.html:6

Hidden file access

- Matting weights are NOT bundled: `matte.cjs` shells the hyperframes CLI's `remove-background`, whi

The referenced dependency cache lives under a hidden home directory. This is expected for model tooling but creates persistent local state outside the project.

Niedrig

Hardcoded URL · 8 Vorkommen

The HTML includes a remote jsDelivr GSAP script, so rendering can contact a third-party CDN and execute remote JavaScript unless assets are vendored.

Niedrig

modes/standard/fonts/build-fonts-css.cjs:92

Node.js fs stat operations

const outKb = Math.round(fs.statSync(OUT).size / 1024);

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/audio-envelope.cjs:30 scripts/check-rail-climax.cjs:40 scripts/make-composition.cjs:83 scripts/preview-frames.cjs:42

Node.js fs stat operations · 4 Vorkommen

if (fs.existsSync(p)) return p;

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/check-occlusion.cjs:22

Node.js fs stat operations

if (fs.existsSync(bun))

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/check-occlusion.cjs:40

Node.js fs stat operations

if (fs.existsSync(c)) return require(c);

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

Node.js fs stat operations

let stale = force || !fs.existsSync(lp);

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/check-occlusion.cjs:41

Node.js fs stat operations

if (!stale && fs.existsSync(idx) && fs.statSync(idx).mtimeMs > fs.statSync(lp).mtimeMs)

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/check-occlusion.cjs:50

Node.js fs stat operations

if (!fs.existsSync(png)) return null;

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/check-occlusion.cjs:93

Node.js fs stat operations

if (!fs.existsSync(framesDir)) {

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/check-overflow.cjs:30 scripts/measure-layout.cjs:34 scripts/measure-layout.cjs:74

Node.js fs stat operations

const plan = fs.existsSync(planPath) ? JSON.parse(fs.readFileSync(planPath, "utf8")) : {};

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

Environment variable access (dot notation) · 8 Vorkommen

process.env.HYPERFRAMES_ROOT,

The code reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose local tool roots and models. This is configuration, but it can change executed code paths.

Niedrig

Environment variable object · 8 Vorkommen

process.env.HYPERFRAMES_ROOT,

The code reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose local tool roots and models. This is configuration, but it can change executed code paths.

Niedrig

Node.js fs stat operations · 3 Vorkommen

if (fs.existsSync(bunDir)) {

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/check-overflow.cjs:40 scripts/measure-layout.cjs:45 scripts/measure-layout.cjs:85

Node.js fs stat operations · 3 Vorkommen

if (fs.existsSync(p)) {

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/check-overflow.cjs:57 scripts/measure-layout.cjs:103

Node.js fs stat operations · 2 Vorkommen

if (!fs.existsSync(indexPath)) {

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/check-overflow.cjs:77 scripts/check-rail-climax.cjs:167 scripts/measure-layout.cjs:139 scripts/preview-frames.cjs:208

Node.js fs stat operations · 4 Vorkommen

executablePath: fs.existsSync(exe) ? exe : undefined,

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/check-rail-climax.cjs:32 scripts/preview-frames.cjs:36 scripts/safe-zones.cjs:34

Node.js fs stat operations · 3 Vorkommen

if (fs.existsSync(bunDir))

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/check-rail-climax.cjs:155

Node.js fs stat operations

if (!fs.existsSync(railPath) || !fs.existsSync(indexPath))

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/lib-dna.cjs:39

Node.js fs stat operations

if (!fs.existsSync(p)) {

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/make-cinematic.cjs:74

Node.js fs stat operations

if (!fs.existsSync(cj)) die(`missing ${cj} — author it first (schema in this header)`);

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/make-cinematic.cjs:75

Node.js fs stat operations

if (!fs.existsSync(tj)) die(`missing ${tj} — run prepare.sh first`);

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/make-cinematic.cjs:177

Node.js fs stat operations

if (!fs.existsSync(fp)) continue;

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/make-composition.cjs:41

Node.js fs stat operations

if (!fs.existsSync(p)) continue;

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/make-composition.cjs:86

Node.js fs stat operations

.filter((d) => fs.existsSync(path.join(TEMPLATES, d, "template.html")))

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/make-composition.cjs:242

Node.js fs stat operations

if (!fs.existsSync(planPath)) {

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/make-theme.cjs:8731

Hardcoded URL

const GSAP = `<script src="https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js"></script>`;

The HTML includes a remote jsDelivr GSAP script, so rendering can contact a third-party CDN and execute remote JavaScript unless assets are vendored.

Niedrig

Node.js fs stat operations

} else if (fs.existsSync(path.join(PROJECT, "rail.html"))) {

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/matte.cjs:41

Node.js fs stat operations

if (fs.existsSync(cli)) return cli;

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/matte.cjs:49 scripts/matte.cjs:137 scripts/transcribe.cjs:151

Node.js fs stat operations · 3 Vorkommen

if (!fs.existsSync(src)) {

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/matte.cjs:172

Node.js fs stat operations

if (!fs.existsSync(cfr)) {

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/matte.cjs:202

Node.js fs stat operations

const cached = fs.existsSync(

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/matte.cjs:219

Node.js fs stat operations

if (r.status !== 0 || !fs.existsSync(mov)) {

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/measure-layout.cjs:187 scripts/preview-frames.cjs:105

Node.js fs stat operations

if (fs.existsSync(planPath)) plan = JSON.parse(fs.readFileSync(planPath, "utf8"));

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

Node.js fs stat operations · 2 Vorkommen

if (fs.existsSync(fontsCss))

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/preview-frames.cjs:135

Node.js fs stat operations

if (!fs.existsSync(idx)) {

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/preview-frames.cjs:140

Node.js fs stat operations

const hasRail = fs.existsSync(railP);

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/preview-frames.cjs:142

Node.js fs stat operations

const hasFg = fs.existsSync(fgP); // hybrid: fg caps render ABOVE the matte (like the real composite

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/preview-frames.cjs:179

Node.js fs stat operations

const n = fs.existsSync(path.join(project, "frames_bg"))

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/preview-frames.cjs:217

Node.js fs stat operations

if (!fs.existsSync(bg)) {

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/preview-frames.cjs:224

Node.js fs stat operations

if (!globalFg && fs.existsSync(fg)) layers.push({ input: fg }); // subject occludes embed

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/safe-zones.cjs:40

Node.js fs stat operations

if (fs.existsSync(c)) {

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/safe-zones.cjs:521

Node.js fs stat operations

if (!fs.existsSync(tp)) return [];

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/safe-zones.cjs:556

Node.js fs stat operations

if (!fs.existsSync(fgDir)) {

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/safe-zones.cjs:588

Node.js fs stat operations

const hasBg = fs.existsSync(bgDir);

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/safe-zones.cjs:608

Node.js fs stat operations

if (hasBg && fs.existsSync(path.join(bgDir, frames[i]))) {

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/safe-zones.cjs:706

Node.js fs stat operations

if (hasBg && fs.existsSync(midBg)) {

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/transcribe.cjs:22

Node.js fs stat operations

if (fs.existsSync(path.join(r, "packages", "cli", "dist", "cli.js"))) return r;

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/transcribe.cjs:28

Node.js fs stat operations

if (fs.existsSync(src)) return src;

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/transcribe.cjs:39

Node.js fs stat operations

let found = cands.sort((a, b) => fs.statSync(b).size - fs.statSync(a).size)[0];

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/transcribe.cjs:156

Node.js fs stat operations

if (!fs.existsSync(audio))

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

Environment variable access (dot notation)

const model = process.argv[3] || process.env.WHISPER_MODEL || "small";

The code reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose local tool roots and models. This is configuration, but it can change executed code paths.

Niedrig

Environment variable access (dot notation)

const language = process.argv[4] || process.env.WHISPER_LANG || "";

The code reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose local tool roots and models. This is configuration, but it can change executed code paths.

Niedrig

Environment variable access (dot notation)

const wantWx = (process.env.TRANSCRIBE_ENGINE || "whisperx") === "whisperx";

The code reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose local tool roots and models. This is configuration, but it can change executed code paths.

Niedrig

Environment variable object

const model = process.argv[3] || process.env.WHISPER_MODEL || "small";

The code reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose local tool roots and models. This is configuration, but it can change executed code paths.

Niedrig

Environment variable object

const language = process.argv[4] || process.env.WHISPER_LANG || "";

The code reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose local tool roots and models. This is configuration, but it can change executed code paths.

Niedrig

scripts/make-theme.cjs:498

Environment variable object

const wantWx = (process.env.TRANSCRIBE_ENGINE || "whisperx") === "whisperx";

The code reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose local tool roots and models. This is configuration, but it can change executed code paths.

Statische falsch positive Treffer ignoriert (9)

Diese statischen Treffer wurden durch semantische Prüfung verworfen oder entsprachen reinen Schema-Tokens; daher werden sie aus Transparenzgründen angezeigt, beeinflussen jedoch nicht die Qualitätsbewertung.

Kritisch

CATALOG.md:56

Ransom message keywords

| `ransom` | cutout-chip collage rail + ransom-note slam apex | kidnapper's collage — e

Force-confirmed blocker/critical static finding; AI dismissal overridden.

Kritisch

Ransom message keywords

// ransom-note letter chips (demo: 10 chips, 4 recipes/fonts cycled, base

Force-confirmed blocker/critical static finding; AI dismissal overridden.

Kritisch

scripts/make-theme.cjs:4829

Ransom message keywords

// ---- ransom shared pieces: the cutout-chip recipes and the seeded paper-tear

Force-confirmed blocker/critical static finding; AI dismissal overridden.

Kritisch

scripts/make-theme.cjs:8539

Ransom message keywords

// The hero word slams in BEHIND the subject as a ransom note: one cutout

Force-confirmed blocker/critical static finding; AI dismissal overridden.

Kritisch

scripts/make-theme.cjs:8601

Ransom message keywords

// ===== letter-by-letter ransom slam: S_k = I + 0.01 + STEP*k, contact = S_k + CRUSH

Force-confirmed blocker/critical static finding; AI dismissal overridden.

Kritisch

SKILL.md:3

Ransom message keywords

description: 'Add captions to a talking-head video. ONE catalog (CATALOG.md) of 32 visual identities

Force-confirmed blocker/critical static finding; AI dismissal overridden.

Kritisch

themes/ransom.json:2

Ransom message keywords

"name": "ransom",

Force-confirmed blocker/critical static finding; AI dismissal overridden.

Kritisch

themes/ransom.json:3

Ransom message keywords

"voice": "kidnapper's collage — every word is a cutout chip clipped from a different page (cream Ant

Force-confirmed blocker/critical static finding; AI dismissal overridden.

Kritisch

themes/README.md:104

Ransom message keywords

| `ransomnote` | RANSOM NOTE slam behind the subject: one cutout chip per letter (4 recipes cycled,

Force-confirmed blocker/critical static finding; AI dismissal overridden.

Risikofaktoren

🌐 Netzwerkzugriff (11)

📁 Dateisystemzugriff (321)

⚙️ Externe Befehle (798)

⚡ Enthält Skripte (12)

🔑 Umgebungsvariablen (22)

Geprüft von: codex

Audit-Version 2

5. Juli 2026, 15:34

Gescannte Dateien

25,422

Analysierte Zeilen

374

Prüfelemente

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (3)

Hoch

SKILL.md:120

Unpinned Global Skill Auto-Update

The behavior is explicitly documented on line 120. I did not verify the external CLI implementation, so confidence is high but not absolute.

Hoch

SKILL.md:280 SKILL.md:284

Runtime Download and Execution Supply Chain

The skill relies on uvx WhisperX and hyperframes model downloads during normal operation. This executes or stores third-party code and model artifacts outside the project directory.

The dependency and model download behavior is stated directly in the dependency section. The static findings also show matching child_process and hidden-cache usage.

Niedrig

scripts/audio-envelope.cjs:15 scripts/check-occlusion.cjs:10 scripts/make-cinematic.cjs:172 scripts/make-composition.cjs:18 scripts/matte.cjs:31 scripts/transcribe.cjs:13

Unscanned file (too_large) — manual review required

[unscanned: too_large]

This binary or oversized asset was not statically inspected. It appears to be a font asset, but marketplace review should verify provenance before publication.

Elemente der Fähigkeitsprüfung (366)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Hoch

Node.js child_process module · 6 Vorkommen

const cp = require("child_process");

The script imports child_process and the skill pipeline uses it to run ffmpeg, node, uvx, python, or hyperframes tools. That is real local command execution capability.

Hoch

scripts/audio-envelope.cjs:54

Synchronous file execution

out = cp.execFileSync(

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

scripts/check-occlusion.cjs:44

Synchronous file execution

cp.execFileSync("node", [path.join(__dirname, "measure-layout.cjs"), project], {

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

scripts/make-cinematic.cjs:715

Node.js child_process module

const cp2 = require("child_process");

The script imports child_process and the skill pipeline uses it to run ffmpeg, node, uvx, python, or hyperframes tools. That is real local command execution capability.

Hoch

scripts/make-cinematic.cjs:179 scripts/matte.cjs:114 scripts/matte.cjs:176 scripts/matte.cjs:227 scripts/transcribe.cjs:157

Node.js child_process module

require("child_process").spawnSync(

The script imports child_process and the skill pipeline uses it to run ffmpeg, node, uvx, python, or hyperframes tools. That is real local command execution capability.

Hoch

Synchronous file execution · 5 Vorkommen

cp.execFileSync(

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

scripts/make-cinematic.cjs:716

Synchronous spawn

let r = cp2.spawnSync("node", [path.join(__dirname, "make-composition.cjs"), project], {

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

scripts/make-cinematic.cjs:756 scripts/make-cinematic.cjs:925

Synchronous spawn · 2 Vorkommen

cp2.spawnSync(

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

scripts/make-cinematic.cjs:798 scripts/make-cinematic.cjs:1198

Synchronous spawn · 2 Vorkommen

cp2.spawnSync("node", [path.join(__dirname, "make-composition.cjs"), project], {

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

scripts/make-cinematic.cjs:1147

Synchronous spawn

require("child_process").spawnSync(

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

Synchronous spawn

r = cp2.spawnSync("node", [path.join(__dirname, "make-composition.cjs"), project], {

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

scripts/make-cinematic.cjs:1163

Synchronous spawn

cp2.spawnSync("node", [path.join(__dirname, "measure-layout.cjs"), project, String(midT)], {

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

scripts/make-composition.cjs:44

Synchronous file execution

.execFileSync(

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

scripts/make-theme.cjs:39

Node.js child_process module

const { execFileSync } = require("child_process");

The script imports child_process and the skill pipeline uses it to run ffmpeg, node, uvx, python, or hyperframes tools. That is real local command execution capability.

Hoch

scripts/make-theme.cjs:70

Synchronous file execution

const out = execFileSync(

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

scripts/make-theme.cjs:1284 scripts/make-theme.cjs:7013 scripts/make-theme.cjs:7183

Synchronous file execution · 3 Vorkommen

const D = execFileSync(

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

scripts/make-theme.cjs:7676 scripts/make-theme.cjs:7903 scripts/make-theme.cjs:8112

Synchronous file execution · 3 Vorkommen

let D = execFileSync(

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

scripts/matte.cjs:77

Synchronous file execution

.execFileSync("ffprobe", [

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

scripts/matte.cjs:215

Synchronous spawn

const r = cp.spawnSync("node", [hfCli(), "remove-background", matteSrc, "-o", mov], {

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

Hidden file in home directory

* weights — the model auto-downloads once (~168 MB) to ~/.cache/hyperframes/.

The skill documents downloads or cache writes under hidden home directories such as ~/.cache/hyperframes. Persistent hidden cache writes require user awareness and provenance checks.

Hoch

scripts/render-and-composite.sh:299

Symlink creation · 2 Vorkommen

fs.symlinkSync(path.basename(found), src);

The skill creates symlinks for source media or shadow render assets. Symlink creation can expose or overwrite unexpected paths if project directories are untrusted.

Hoch

Symlink creation

ln -sf "$p" "$sh/$b"

The skill creates symlinks for source media or shadow render assets. Symlink creation can expose or overwrite unexpected paths if project directories are untrusted.

Hoch

scripts/transcribe.cjs:172

Synchronous file execution

cp.execFileSync("ffmpeg", ["-y", "-i", src, "-vn", "-ac", "1", "-ar", "16000", wav], {

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

scripts/transcribe.cjs:251

Synchronous file execution

const so = cp.execFileSync("node", [cli, ...args], { encoding: "utf8" });

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

scripts/transcribe.cjs:57 scripts/transcribe.cjs:77

Synchronous spawn · 2 Vorkommen

const r = cp.spawnSync(

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

scripts/transcribe.cjs:201

Synchronous spawn

let r = cp.spawnSync("uvx", wxArgs, { encoding: "utf8", timeout: 600000 });

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

scripts/transcribe.cjs:203

Synchronous spawn

r = cp.spawnSync(

The script synchronously executes external binaries or Node helpers during transcription, matting, rendering, or validation. Arguments are generally array-based, but local command execution is real.

Hoch

Hidden file in home directory

- **Node-first; two Python touchpoints via `uvx` (no manual installs):** transcription runs WhisperX

The skill documents downloads or cache writes under hidden home directories such as ~/.cache/hyperframes. Persistent hidden cache writes require user awareness and provenance checks.

Hoch

modes/standard/_anatomy.md:179

Hidden file in home directory

- Matting weights are NOT bundled: `matte.cjs` shells the hyperframes CLI's `remove-background`, whi

The skill documents downloads or cache writes under hidden home directories such as ~/.cache/hyperframes. Persistent hidden cache writes require user awareness and provenance checks.

Mittel

innerHTML assignment (XSS risk)

flow.innerHTML = line.words

The example inserts caption words into innerHTML, which would be unsafe if copied with transcript text that contains markup. The location is documentation, so confidence is moderate.

Mittel

Node.js fs operations

const buf = fs.readFileSync(path.join(FILES, f));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

fs.writeFileSync(OUT, header + "\n" + faces.join("\n\n") + "\n");

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

const buf = fs.readFileSync(path.join(FILES, f));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

references/test-set.md:27

Synchronous file operations

fs.writeFileSync(OUT, header + "\n" + faces.join("\n\n") + "\n");

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Temp directory access

bash scripts/render-and-composite.sh /tmp/ts-${case}

The documented test command writes projects under /tmp, which is normal for tests but still uses shared temporary filesystem space.

Mittel

Node.js fs operations

fs.writeFileSync(path.join(project, "envelope.json"), JSON.stringify({ hop: HOP, rms }));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

fs.writeFileSync(path.join(project, "envelope.json"), JSON.stringify({ hop: HOP, rms }));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/check-occlusion.cjs:23

Dynamic require with variable

if (fs.existsSync(c)) return require(c);

The skill resolves dependencies or JSON inputs dynamically instead of using a pinned import path. This is intended tooling, but it can load code or data from mutable local locations.

Mittel

Node.js fs operations

for (const d of fs.readdirSync(bun))

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

return JSON.parse(fs.readFileSync(lp, "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

const plan = fs.existsSync(planPath) ? JSON.parse(fs.readFileSync(planPath, "utf8")) : {};

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

return JSON.parse(fs.readFileSync(lp, "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/check-overflow.cjs:41 scripts/check-rail-climax.cjs:52 scripts/measure-layout.cjs:46 scripts/preview-frames.cjs:54

Synchronous file operations

const plan = fs.existsSync(planPath) ? JSON.parse(fs.readFileSync(planPath, "utf8")) : {};

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Dynamic require with variable · 4 Vorkommen

puppeteer = require(p);

The skill resolves dependencies or JSON inputs dynamically instead of using a pinned import path. This is intended tooling, but it can load code or data from mutable local locations.

Mittel

scripts/check-overflow.cjs:31 scripts/check-rail-climax.cjs:33 scripts/preview-frames.cjs:37 scripts/safe-zones.cjs:35

Node.js fs operations · 4 Vorkommen

for (const d of fs.readdirSync(bunDir))

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

const html = fs.readFileSync(indexPath, "utf8");

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/check-rail-climax.cjs:58 scripts/preview-frames.cjs:66

Synchronous file operations

const html = fs.readFileSync(indexPath, "utf8");

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations · 2 Vorkommen

if (g) gsapSource = fs.readFileSync(g, "utf8");

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/check-rail-climax.cjs:58 scripts/preview-frames.cjs:66

Synchronous file operations · 2 Vorkommen

if (g) gsapSource = fs.readFileSync(g, "utf8");

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/check-timing.cjs:55 scripts/preview-frames.cjs:161

Node.js fs operations · 2 Vorkommen

const plan = JSON.parse(fs.readFileSync(path.join(project, "plan.json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/check-timing.cjs:55 scripts/preview-frames.cjs:161

Node.js fs operations

const t = JSON.parse(fs.readFileSync(path.join(project, "transcript.json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations · 2 Vorkommen

const plan = JSON.parse(fs.readFileSync(path.join(project, "plan.json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/fill-timings.cjs:73 scripts/fit-fonts.cjs:95

Synchronous file operations

const t = JSON.parse(fs.readFileSync(path.join(project, "transcript.json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations · 2 Vorkommen

plan = JSON.parse(fs.readFileSync(planPath, "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/fill-timings.cjs:113 scripts/fit-fonts.cjs:154

Node.js fs operations

trWordsRaw = JSON.parse(fs.readFileSync(trPath, "utf8")).words || [];

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations · 2 Vorkommen

fs.writeFileSync(planPath, JSON.stringify(plan, null, 2));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/fill-timings.cjs:73 scripts/fit-fonts.cjs:95

Synchronous file operations · 2 Vorkommen

plan = JSON.parse(fs.readFileSync(planPath, "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/fill-timings.cjs:113 scripts/fit-fonts.cjs:154

Synchronous file operations

trWordsRaw = JSON.parse(fs.readFileSync(trPath, "utf8")).words || [];

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations · 2 Vorkommen

fs.writeFileSync(planPath, JSON.stringify(plan, null, 2));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

css = fs.readFileSync(FONTS_CSS, "utf8");

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/inject-fonts.cjs:131 scripts/inject-fonts.cjs:142

Node.js fs operations

html = fs.readFileSync(file, "utf8");

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations · 2 Vorkommen

fs.writeFileSync(file, html);

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

css = fs.readFileSync(FONTS_CSS, "utf8");

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/inject-fonts.cjs:131 scripts/inject-fonts.cjs:142

Synchronous file operations

html = fs.readFileSync(file, "utf8");

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations · 2 Vorkommen

fs.writeFileSync(file, html);

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/lib-dna.cjs:42 scripts/lib-dna.cjs:47 scripts/make-theme.cjs:98

Node.js fs operations · 3 Vorkommen

return JSON.parse(fs.readFileSync(p, "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/lib-dna.cjs:42 scripts/lib-dna.cjs:47 scripts/make-theme.cjs:98

Synchronous file operations · 3 Vorkommen

return JSON.parse(fs.readFileSync(p, "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

const C = JSON.parse(fs.readFileSync(cj, "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

const tr = (JSON.parse(fs.readFileSync(tj, "utf8")).words || []).filter(

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/make-cinematic.cjs:174

Node.js fs operations

sz = JSON.parse(fs.readFileSync(path.join(project, "safe-zones.json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

fs.readdirSync(project).filter((x) => /\.(mp4|mov|webm)$/i.test(x)),

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/make-cinematic.cjs:708 scripts/make-cinematic.cjs:797 scripts/make-cinematic.cjs:859 scripts/make-cinematic.cjs:1146 scripts/make-cinematic.cjs:1197

Node.js fs operations · 5 Vorkommen

fs.writeFileSync(path.join(project, "plan.json"), JSON.stringify(plan, null, 2));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/make-cinematic.cjs:802 scripts/make-cinematic.cjs:1151 scripts/make-cinematic.cjs:1193

Node.js fs operations

lay = JSON.parse(fs.readFileSync(path.join(project, "_layout.json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations · 3 Vorkommen

fs.unlinkSync(path.join(project, "_layout.json"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

const ss = JSON.parse(fs.readFileSync(path.join(project, "_layout.json"), "utf8")).samples;

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

JSON.parse(fs.readFileSync(path.join(project, "_layout.json"), "utf8")).samples[0].caps ||

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

const C = JSON.parse(fs.readFileSync(cj, "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

const tr = (JSON.parse(fs.readFileSync(tj, "utf8")).words || []).filter(

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/make-cinematic.cjs:708 scripts/make-cinematic.cjs:797 scripts/make-cinematic.cjs:859 scripts/make-cinematic.cjs:1146 scripts/make-cinematic.cjs:1197

Synchronous file operations

sz = JSON.parse(fs.readFileSync(path.join(project, "safe-zones.json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations · 5 Vorkommen

fs.writeFileSync(path.join(project, "plan.json"), JSON.stringify(plan, null, 2));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

lay = JSON.parse(fs.readFileSync(path.join(project, "_layout.json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

const ss = JSON.parse(fs.readFileSync(path.join(project, "_layout.json"), "utf8")).samples;

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

JSON.parse(fs.readFileSync(path.join(project, "_layout.json"), "utf8")).samples[0].caps ||

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

const plan = JSON.parse(fs.readFileSync(planPath, "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

? fs.readFileSync(path.join(TEMPLATES, "engine.html"), "utf8")

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

: fs.readFileSync(findTemplate(plan.template), "utf8");

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

fs.writeFileSync(path.join(project, "index.html"), src);

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

fs.writeFileSync(path.join(project, "index_fg.html"), fg);

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

const plan = JSON.parse(fs.readFileSync(planPath, "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

? fs.readFileSync(path.join(TEMPLATES, "engine.html"), "utf8")

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

: fs.readFileSync(findTemplate(plan.template), "utf8");

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

fs.writeFileSync(path.join(project, "index.html"), src);

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/make-theme.cjs:8766

Synchronous file operations

fs.writeFileSync(path.join(project, "index_fg.html"), fg);

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Shell command substitution

cd "$(dirname "$0")"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/make-theme.cjs:8763-8773

Template literal with command substitution

`#!/usr/bin/env bash

The compiler writes a shell script containing command substitution into the project. This is expected post-processing behavior, but it expands the local command-execution surface.

Mittel

Node.js fs operations

const theme = JSON.parse(fs.readFileSync(path.join(PROJECT, "theme.json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

const dna = JSON.parse(fs.readFileSync(path.join(SKILL, "themes", theme.dna + ".json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

const transcript = JSON.parse(fs.readFileSync(path.join(PROJECT, "transcript.json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/make-theme.cjs:85

Node.js fs operations

fs.readFileSync(path.join(PROJECT, "matte.fps"), "utf8").replace(/\D/g, ""),

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

const n = fs.readdirSync(path.join(PROJECT, "frames_fg")).length;

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/make-theme.cjs:517 scripts/make-theme.cjs:5138

Node.js fs operations

return JSON.parse(fs.readFileSync(path.join(SKILL, "assets/fonts/char-widths.json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations · 2 Vorkommen

fs.readFileSync(path.join(SKILL, "assets/brand/cyberpunk-widths.json"), "utf8"),

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

css = fs.readFileSync(path.join(SKILL, "modes/standard/fonts/fonts.css"), "utf8");

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

fs.writeFileSync(path.join(PROJECT, "index.html"), bgHtml);

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/make-theme.cjs:8732

Node.js fs operations

fs.writeFileSync(path.join(PROJECT, "rail.html"), fgHtml);

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

fs.unlinkSync(path.join(PROJECT, "rail.html"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/make-theme.cjs:8761 scripts/transcribe.cjs:294

Node.js fs operations · 2 Vorkommen

fs.writeFileSync(

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

const theme = JSON.parse(fs.readFileSync(path.join(PROJECT, "theme.json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

const dna = JSON.parse(fs.readFileSync(path.join(SKILL, "themes", theme.dna + ".json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

const transcript = JSON.parse(fs.readFileSync(path.join(PROJECT, "transcript.json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

fs.readFileSync(path.join(PROJECT, "matte.fps"), "utf8").replace(/\D/g, ""),

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/make-theme.cjs:517 scripts/make-theme.cjs:5138

Synchronous file operations

return JSON.parse(fs.readFileSync(path.join(SKILL, "assets/fonts/char-widths.json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations · 2 Vorkommen

fs.readFileSync(path.join(SKILL, "assets/brand/cyberpunk-widths.json"), "utf8"),

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/make-theme.cjs:5141

Synchronous file operations

css = fs.readFileSync(path.join(SKILL, "modes/standard/fonts/fonts.css"), "utf8");

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

.readFileSync(path.join(SKILL, "assets/brand/CyberpunkReplica.ttf"))

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

fs.writeFileSync(path.join(PROJECT, "index.html"), bgHtml);

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/make-theme.cjs:8761 scripts/transcribe.cjs:294

Synchronous file operations

fs.writeFileSync(path.join(PROJECT, "rail.html"), fgHtml);

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations · 2 Vorkommen

fs.writeFileSync(

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/matte.cjs:58 scripts/transcribe.cjs:44

Node.js fs operations · 2 Vorkommen

fs.symlinkSync(path.basename(found), src);

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations · 2 Vorkommen

fs.copyFileSync(found, src);

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/matte.cjs:112

Node.js fs operations

fs.mkdirSync(dst, { recursive: true });

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/matte.cjs:113

Node.js fs operations

if (fs.readdirSync(dst).some((f) => f.endsWith(".png"))) return false;

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/matte.cjs:124

Node.js fs operations

return fs.readdirSync(dir).filter((f) => f.endsWith(".png")).length;

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

fps = parseInt(fs.readFileSync(fpsFile, "utf8").replace(/\D/g, ""), 10) || 0;

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/matte.cjs:255 scripts/matte.cjs:265

Node.js fs operations

fs.writeFileSync(fpsFile, String(fps));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/matte.cjs:226

Node.js fs operations

fs.mkdirSync(framesFg, { recursive: true });

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/matte.cjs:232

Node.js fs operations

fs.rmSync(mov, { force: true });

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/matte.cjs:253

Node.js fs operations

fs.mkdirSync(tmp, { recursive: true });

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations · 2 Vorkommen

fs.copyFileSync(

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/matte.cjs:260

Node.js fs operations

fs.rmSync(framesFg, { recursive: true, force: true });

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/matte.cjs:261

Node.js fs operations

fs.renameSync(tmp, framesFg);

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

fps = parseInt(fs.readFileSync(fpsFile, "utf8").replace(/\D/g, ""), 10) || 0;

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

fs.writeFileSync(fpsFile, String(fps));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/measure-layout.cjs:35 scripts/measure-layout.cjs:75

Hidden file access

* weights — the model auto-downloads once (~168 MB) to ~/.cache/hyperframes/.

The referenced dependency cache lives under a hidden home directory. This is expected for model tooling but creates persistent local state outside the project.

Mittel

Node.js fs operations · 2 Vorkommen

for (const d of fs.readdirSync(bunDir)) {

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

gsapSource = fs.readFileSync(p, "utf8");

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/measure-layout.cjs:188 scripts/preview-frames.cjs:106

Node.js fs operations

if (fs.existsSync(planPath)) plan = JSON.parse(fs.readFileSync(planPath, "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations · 2 Vorkommen

await page.addStyleTag({ content: fs.readFileSync(fontsCss, "utf8") });

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

fs.writeFileSync(outPath, JSON.stringify(layout, null, 2));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

gsapSource = fs.readFileSync(p, "utf8");

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/measure-layout.cjs:188 scripts/preview-frames.cjs:106

Synchronous file operations

if (fs.existsSync(planPath)) plan = JSON.parse(fs.readFileSync(planPath, "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations · 2 Vorkommen

await page.addStyleTag({ content: fs.readFileSync(fontsCss, "utf8") });

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/prepare.sh:17 scripts/render-and-composite.sh:13 scripts/render-theme.sh:8

Synchronous file operations

fs.writeFileSync(outPath, JSON.stringify(layout, null, 2));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Shell command substitution · 3 Vorkommen

PROJECT="$(cd "$PROJECT" && pwd)"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/prepare.sh:18 scripts/render-theme.sh:9

Shell command substitution · 2 Vorkommen

SD="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/preview-frames.cjs:61

Dynamic require with variable

sharp = require(p);

The skill resolves dependencies or JSON inputs dynamically instead of using a pinned import path. This is intended tooling, but it can load code or data from mutable local locations.

Mittel

scripts/preview-frames.cjs:147 scripts/safe-zones.cjs:582

Node.js fs operations · 2 Vorkommen

String(fs.readFileSync(path.join(project, "matte.fps"), "utf8")).replace(/[^\d.]/g, ""),

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/preview-frames.cjs:180

Node.js fs operations

JSON.parse(fs.readFileSync(path.join(project, "plan.json"), "utf8")).caption_layer === "fg";

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

? fs.readdirSync(path.join(project, "frames_bg")).length

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/preview-frames.cjs:200 scripts/transcribe.cjs:176

Node.js fs operations · 2 Vorkommen

fs.mkdirSync(outDir, { recursive: true });

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/preview-frames.cjs:147 scripts/safe-zones.cjs:582

Synchronous file operations · 2 Vorkommen

String(fs.readFileSync(path.join(project, "matte.fps"), "utf8")).replace(/[^\d.]/g, ""),

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

JSON.parse(fs.readFileSync(path.join(project, "plan.json"), "utf8")).caption_layer === "fg";

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Dynamic require with variable

PFPS="$(node -e 'try{process.stdout.write(String(require(process.argv[1]).fps??""))}catch(e){}' "$PR

The skill resolves dependencies or JSON inputs dynamically instead of using a pinned import path. This is intended tooling, but it can load code or data from mutable local locations.

Mittel

Dynamic require with variable

FPS="$(node -e 'process.stdout.write(String(require(process.argv[1]).fps??24))' "$PROJECT/plan.json"

The skill resolves dependencies or JSON inputs dynamically instead of using a pinned import path. This is intended tooling, but it can load code or data from mutable local locations.

Mittel

scripts/render-and-composite.sh:18

Dynamic require with variable

CAPTION_LAYER="$(node -e 'process.stdout.write(String(require(process.argv[1]).caption_layer??"bg"))

The skill resolves dependencies or JSON inputs dynamically instead of using a pinned import path. This is intended tooling, but it can load code or data from mutable local locations.

Mittel

Shell command substitution

SKILL_SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:20

Shell command substitution

for cand in "${2:-}" "${HYPERFRAMES_ROOT:-}" "$(cd "$SKILL_SCRIPT_DIR/../../.." 2>/dev/null && pwd)"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:43 scripts/render-and-composite.sh:58 scripts/render-and-composite.sh:64

Shell command substitution · 3 Vorkommen

C="$(compiler_for)"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:45 scripts/render-and-composite.sh:60

Shell command substitution · 2 Vorkommen

node "$(dirname "$0")/$C" "$PROJECT"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:49 scripts/render-and-composite.sh:56

Shell command substitution · 2 Vorkommen

node "$(dirname "$0")/make-cinematic.cjs" "$PROJECT"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:69

Shell command substitution

ENGINE="$(dirname "$0")/../modes/cinematic/engine.html"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:70

Shell command substitution

if [[ "$(dirname "$0")/$RECOMPILER" -nt "$PROJECT/index.html" || "$(dirname "$0")/lib-dna.cjs" -nt "

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:72

Shell command substitution

node "$(dirname "$0")/$RECOMPILER" "$PROJECT"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:84

Shell command substitution

node "$(dirname "$0")/inject-fonts.cjs" "$PROJECT" \

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:96

Shell command substitution

if ! node "$(dirname "$0")/check-timing.cjs" "$PROJECT" --strict; then

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:112

Shell command substitution

node "$(dirname "$0")/check-occlusion.cjs" "$PROJECT" --strict > "$OCC_LOG" 2>&1 &

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:146

Shell command substitution

if [[ ! -f "$PROJECT/plan.json" && -f "$PROJECT/index.html" && -f "$(dirname "$0")/check-overflow.cj

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:147

Shell command substitution

node "$(dirname "$0")/check-overflow.cjs" "$PROJECT" \

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:154

Shell command substitution

if [[ -f "$PROJECT/rail.html" && -f "$(dirname "$0")/check-overflow.cjs" ]]; then

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:155

Shell command substitution

if node "$(dirname "$0")/check-overflow.cjs" "$PROJECT" rail.html; then

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:167

Shell command substitution

if [[ -f "$PROJECT/rail.html" && -f "$PROJECT/index.html" && -f "$(dirname "$0")/check-rail-climax.c

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:168

Shell command substitution

if ! node "$(dirname "$0")/check-rail-climax.cjs" "$PROJECT"; then

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:187

Shell command substitution

FPS="$(tr -dc '0-9' < "$PROJECT/matte.fps")"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

Shell command substitution

PFPS="$(node -e 'try{process.stdout.write(String(require(process.argv[1]).fps??""))}catch(e){}' "$PR

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:199

Shell command substitution

FPS="$(node -e 'process.stdout.write(String(require(process.argv[1]).fps??24))' "$PROJECT/plan.json"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

Shell command substitution

N="$(ls "$PROJECT/frames_fg" | wc -l | tr -d ' ')"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:200

Shell command substitution

DUR="$(grep -oE 'data-duration="[0-9.]+"' "$PROJECT/index.html" | head -1 | grep -oE '[0-9.]+' || ec

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:202

Shell command substitution

FPS="$(awk "BEGIN{printf \"%d\", $N/$DUR + 0.5}")"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:220

Shell command substitution

CAPTION_LAYER="$(node -e 'process.stdout.write(String(require(process.argv[1]).caption_layer??"bg"))

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

Shell command substitution

ATTR="$(grep -oE 'data-caption-layer="(bg|fg)"' "$PROJECT/index.html" | head -1 | grep -oE '(bg|fg)'

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:233

Shell command substitution

STAMP="$(date +%Y%m%d-%H%M%S)"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:248

Shell command substitution

N_FRAMES="$(ls "$PROJECT/frames_fg" 2>/dev/null | wc -l | tr -d ' ')"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:249

Shell command substitution

HF_TIMEOUT_S="${HF_TIMEOUT_S:-$(( N_FRAMES * 3 / 2 > 240 ? N_FRAMES * 3 / 2 : 240 ))}"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:265

Shell command substitution

elapsed=$((SECONDS - start))

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:268

Shell command substitution

[[ -f "$out" ]] && sz=$(stat -f%z "$out" 2>/dev/null || echo 0)

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:295

Shell command substitution

b="$(basename "$p")"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:355

Shell command substitution

W="$(ffprobe -v error -select_streams v:0 -show_entries stream=width -of default=nw=1:nk=1 "$BG")"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:356

Shell command substitution

H="$(ffprobe -v error -select_streams v:0 -show_entries stream=height -of default=nw=1:nk=1 "$BG")"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:367

Shell command substitution

MATTE_DUR="$(awk "BEGIN{printf \"%.3f\", $(ls "$PROJECT/frames_fg" | wc -l)/$FPS}")"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:368

Shell command substitution

SRC_DUR="$(ffprobe -v error -show_entries format=duration -of csv=p=0 "$PROJECT/source.mp4" 2>/dev/n

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:370

Shell command substitution

MATTE_DUR="$(awk "BEGIN{m=$MATTE_DUR; s=$SRC_DUR; printf \"%.3f\", (s>0 && s<m) ? s : m}")"

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/render-and-composite.sh:381

Shell command substitution

BG_DUR="$(ffprobe -v error -show_entries format=duration -of default=nokey=1:noprint_wrappers=1 "$BG

The shell script uses command substitution while resolving paths or reading project metadata. Variables are mostly quoted, but the skill still executes local shell commands during normal operation.

Mittel

scripts/safe-zones.cjs:41

Dynamic require with variable

sharp = require(c);

The skill resolves dependencies or JSON inputs dynamically instead of using a pinned import path. This is intended tooling, but it can load code or data from mutable local locations.

Mittel

Node.js fs operations

words = (JSON.parse(fs.readFileSync(tp, "utf8")).words || []).filter((w) => w && "start" in w);

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

fs.writeFileSync(path.join(project, "safe-zones.json"), JSON.stringify(out, null, 2));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

words = (JSON.parse(fs.readFileSync(tp, "utf8")).words || []).filter((w) => w && "start" in w);

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

fs.writeFileSync(path.join(project, "safe-zones.json"), JSON.stringify(out, null, 2));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

const d = JSON.parse(fs.readFileSync(out, "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

scripts/transcribe.cjs:235

Node.js fs operations

const wxJson = JSON.parse(fs.readFileSync(path.join(outDir, "_wx_audio.json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

fs.unlinkSync(wav);

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Node.js fs operations

const flat = JSON.parse(fs.readFileSync(flatPath, "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

const d = JSON.parse(fs.readFileSync(out, "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

const wxJson = JSON.parse(fs.readFileSync(path.join(outDir, "_wx_audio.json"), "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Synchronous file operations

const flat = JSON.parse(fs.readFileSync(flatPath, "utf8"));

The script reads and writes project media, transcripts, generated HTML, plans, and render outputs. This filesystem access is intentional but real and should be sandboxed.

Mittel

Hidden file access

- **Node-first; two Python touchpoints via `uvx` (no manual installs):** transcription runs WhisperX

The referenced dependency cache lives under a hidden home directory. This is expected for model tooling but creates persistent local state outside the project.

Mittel

modes/cinematic/_archive/champion/template.html:26 modes/cinematic/_archive/memory-wall/template.html:29 modes/cinematic/_archive/portrait-header/template.html:18 modes/cinematic/cinematic-cream/template.html:87 modes/cinematic/engine.html:29 modes/standard/_anatomy.md:168 references/example-renders/champion.html:6 references/example-renders/memory-wall.html:6

Hidden file access

- Matting weights are NOT bundled: `matte.cjs` shells the hyperframes CLI's `remove-background`, whi

The referenced dependency cache lives under a hidden home directory. This is expected for model tooling but creates persistent local state outside the project.

Niedrig

Hardcoded URL · 8 Vorkommen

The HTML includes a remote jsDelivr GSAP script, so rendering can contact a third-party CDN and execute remote JavaScript unless assets are vendored.

Niedrig

modes/standard/fonts/build-fonts-css.cjs:92

Node.js fs stat operations

const outKb = Math.round(fs.statSync(OUT).size / 1024);

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/audio-envelope.cjs:30 scripts/check-rail-climax.cjs:40 scripts/make-composition.cjs:83 scripts/preview-frames.cjs:42

Node.js fs stat operations · 4 Vorkommen

if (fs.existsSync(p)) return p;

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/check-occlusion.cjs:22

Node.js fs stat operations

if (fs.existsSync(bun))

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/check-occlusion.cjs:40

Node.js fs stat operations

if (fs.existsSync(c)) return require(c);

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

Node.js fs stat operations

let stale = force || !fs.existsSync(lp);

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/check-occlusion.cjs:41

Node.js fs stat operations

if (!stale && fs.existsSync(idx) && fs.statSync(idx).mtimeMs > fs.statSync(lp).mtimeMs)

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/check-occlusion.cjs:50

Node.js fs stat operations

if (!fs.existsSync(png)) return null;

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/check-occlusion.cjs:93

Node.js fs stat operations

if (!fs.existsSync(framesDir)) {

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/check-overflow.cjs:30 scripts/measure-layout.cjs:34 scripts/measure-layout.cjs:74

Node.js fs stat operations

const plan = fs.existsSync(planPath) ? JSON.parse(fs.readFileSync(planPath, "utf8")) : {};

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

Environment variable access (dot notation) · 8 Vorkommen

process.env.HYPERFRAMES_ROOT,

The code reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose local tool roots and models. This is configuration, but it can change executed code paths.

Niedrig

Environment variable object · 8 Vorkommen

process.env.HYPERFRAMES_ROOT,

The code reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose local tool roots and models. This is configuration, but it can change executed code paths.

Niedrig

Node.js fs stat operations · 3 Vorkommen

if (fs.existsSync(bunDir)) {

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/check-overflow.cjs:40 scripts/measure-layout.cjs:45 scripts/measure-layout.cjs:85

Node.js fs stat operations · 3 Vorkommen

if (fs.existsSync(p)) {

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/check-overflow.cjs:57 scripts/measure-layout.cjs:103

Node.js fs stat operations · 2 Vorkommen

if (!fs.existsSync(indexPath)) {

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/check-overflow.cjs:77 scripts/check-rail-climax.cjs:167 scripts/measure-layout.cjs:139 scripts/preview-frames.cjs:208

Node.js fs stat operations · 4 Vorkommen

executablePath: fs.existsSync(exe) ? exe : undefined,

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/check-rail-climax.cjs:32 scripts/preview-frames.cjs:36 scripts/safe-zones.cjs:34

Node.js fs stat operations · 3 Vorkommen

if (fs.existsSync(bunDir))

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/check-rail-climax.cjs:155

Node.js fs stat operations

if (!fs.existsSync(railPath) || !fs.existsSync(indexPath))

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/lib-dna.cjs:39

Node.js fs stat operations

if (!fs.existsSync(p)) {

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/make-cinematic.cjs:74

Node.js fs stat operations

if (!fs.existsSync(cj)) die(`missing ${cj} — author it first (schema in this header)`);

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/make-cinematic.cjs:75

Node.js fs stat operations

if (!fs.existsSync(tj)) die(`missing ${tj} — run prepare.sh first`);

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/make-cinematic.cjs:177

Node.js fs stat operations

if (!fs.existsSync(fp)) continue;

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/make-composition.cjs:41

Node.js fs stat operations

if (!fs.existsSync(p)) continue;

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/make-composition.cjs:86

Node.js fs stat operations

.filter((d) => fs.existsSync(path.join(TEMPLATES, d, "template.html")))

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/make-composition.cjs:242

Node.js fs stat operations

if (!fs.existsSync(planPath)) {

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/make-theme.cjs:8731

Hardcoded URL

const GSAP = `<script src="https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js"></script>`;

The HTML includes a remote jsDelivr GSAP script, so rendering can contact a third-party CDN and execute remote JavaScript unless assets are vendored.

Niedrig

Node.js fs stat operations

} else if (fs.existsSync(path.join(PROJECT, "rail.html"))) {

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/matte.cjs:41

Node.js fs stat operations

if (fs.existsSync(cli)) return cli;

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/matte.cjs:49 scripts/matte.cjs:137 scripts/transcribe.cjs:151

Node.js fs stat operations · 3 Vorkommen

if (!fs.existsSync(src)) {

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/matte.cjs:172

Node.js fs stat operations

if (!fs.existsSync(cfr)) {

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/matte.cjs:202

Node.js fs stat operations

const cached = fs.existsSync(

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/matte.cjs:219

Node.js fs stat operations

if (r.status !== 0 || !fs.existsSync(mov)) {

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/measure-layout.cjs:187 scripts/preview-frames.cjs:105

Node.js fs stat operations

if (fs.existsSync(planPath)) plan = JSON.parse(fs.readFileSync(planPath, "utf8"));

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

Node.js fs stat operations · 2 Vorkommen

if (fs.existsSync(fontsCss))

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/preview-frames.cjs:135

Node.js fs stat operations

if (!fs.existsSync(idx)) {

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/preview-frames.cjs:140

Node.js fs stat operations

const hasRail = fs.existsSync(railP);

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/preview-frames.cjs:142

Node.js fs stat operations

const hasFg = fs.existsSync(fgP); // hybrid: fg caps render ABOVE the matte (like the real composite

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/preview-frames.cjs:179

Node.js fs stat operations

const n = fs.existsSync(path.join(project, "frames_bg"))

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/preview-frames.cjs:217

Node.js fs stat operations

if (!fs.existsSync(bg)) {

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/preview-frames.cjs:224

Node.js fs stat operations

if (!globalFg && fs.existsSync(fg)) layers.push({ input: fg }); // subject occludes embed

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/safe-zones.cjs:40

Node.js fs stat operations

if (fs.existsSync(c)) {

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/safe-zones.cjs:521

Node.js fs stat operations

if (!fs.existsSync(tp)) return [];

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/safe-zones.cjs:556

Node.js fs stat operations

if (!fs.existsSync(fgDir)) {

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/safe-zones.cjs:588

Node.js fs stat operations

const hasBg = fs.existsSync(bgDir);

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/safe-zones.cjs:608

Node.js fs stat operations

if (hasBg && fs.existsSync(path.join(bgDir, frames[i]))) {

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/safe-zones.cjs:706

Node.js fs stat operations

if (hasBg && fs.existsSync(midBg)) {

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/transcribe.cjs:22

Node.js fs stat operations

if (fs.existsSync(path.join(r, "packages", "cli", "dist", "cli.js"))) return r;

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/transcribe.cjs:28

Node.js fs stat operations

if (fs.existsSync(src)) return src;

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/transcribe.cjs:39

Node.js fs stat operations

let found = cands.sort((a, b) => fs.statSync(b).size - fs.statSync(a).size)[0];

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

scripts/transcribe.cjs:156

Node.js fs stat operations

if (!fs.existsSync(audio))

The script inspects file existence or size while resolving project assets and dependencies. This is low-risk filesystem access but still touches local paths.

Niedrig

Environment variable access (dot notation)

const model = process.argv[3] || process.env.WHISPER_MODEL || "small";

The code reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose local tool roots and models. This is configuration, but it can change executed code paths.

Niedrig

Environment variable access (dot notation)

const language = process.argv[4] || process.env.WHISPER_LANG || "";

The code reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose local tool roots and models. This is configuration, but it can change executed code paths.

Niedrig

Environment variable access (dot notation)

const wantWx = (process.env.TRANSCRIBE_ENGINE || "whisperx") === "whisperx";

The code reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose local tool roots and models. This is configuration, but it can change executed code paths.

Niedrig

Environment variable object

const model = process.argv[3] || process.env.WHISPER_MODEL || "small";

The code reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose local tool roots and models. This is configuration, but it can change executed code paths.

Niedrig

Environment variable object

const language = process.argv[4] || process.env.WHISPER_LANG || "";

The code reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose local tool roots and models. This is configuration, but it can change executed code paths.

Niedrig