Dieser Bericht ist nicht in der angeforderten Sprache verfügbar. Stattdessen wird der maßgebliche englische Bericht angezeigt.
Versionierte Sicherheitsbewertung
Berichts-ID: SA-DBE0E719
7/8/2026, 2:05:16 AM
embedded-captions Sicherheitsbewertung v4
Zertifizierungsbericht zur Skill-Sicherheit
Auditmodell: codex Historischer Bericht
- Skillname
- embedded-captions
- Version
- v4
- Betreuer
- heygen-com
- Abdeckung
- 98 Gescannte Dateien · 25,451 Analysierte Zeilen
- Richtlinienversion
- Nicht verfügbar
Höchster bestätigter Schweregrad eines Befunds
Hoch
2 bestätigte Sicherheitsbefunde erfordern Aufmerksamkeit.
Installationskontext
Historische Nachweise
Dieser Bericht beschreibt möglicherweise nicht das derzeit installierbare Artefakt. Öffnen Sie die aktuelle Skill-Seite für Installationshinweise.
Aktuelle Skill-Seite öffnenDieser Bericht blockiert oder autorisiert weder das Manifest noch die ZIP-Datei.
The critical ransom-related static findings are false positives caused by caption theme names and visual-style prose. Real risks remain: the skill executes local commands, reads and writes project files, creates symlinks, loads CDN scripts in generated HTML, and can download packages or model weights during runtime.
Position melden
Historischer Bericht
Öffnen Sie den Auditverlauf, bevor Sie diesen Bericht zur Installation verwenden.
Audit-Nachweis
Nicht bescheinigungsfähig
Die erforderliche unveränderliche Bindung ist unvollständig.
Menschliche Überprüfung
Nicht überprüft
Für diesen Bericht ist keine menschliche Überprüfung verzeichnet.
Abdeckung
98 Gescannte Dateien · 25,451 Analysierte Zeilen
354 Elemente zur Überprüfung angezeigt
Einschränkungen
Dieser Bericht beansprucht keine Laufzeit- oder Sandbox-Ausführung und beweist nicht das Fehlen von Nebenwirkungen.
Beweiskette
Folgen Sie den Nachweisen von der Quellenbindung bis zum Installationsvertrag. Verfügbare Nachweise unterstützen die Überprüfung; sie sind keine Sicherheitsgarantie.
Quelle
Bindung nicht verfügbar
Artefakt
Identität unvollständig
Prüfung
Vollständig
Beobachtete Funktionen
„Beobachtet“ bedeutet, dass dieser Bericht unterstützende Nachweise erfasst hat. Nicht erfasst bedeutet nicht, dass eine Fähigkeit nicht vorhanden ist.
Enthält Skripte
Kann mit dem Skill enthaltenen Code ausführen.
An 12 Nachweisstellen beobachtet
Netzwerkzugriff
Kann eine Verbindung zu externen Diensten herstellen.
An 11 Nachweisstellen beobachtet
Dateisystemzugriff
Kann lokale Dateien lesen oder schreiben.
An 242 Nachweisstellen beobachtet
Umgebungsvariablen
Kann Werte aus der Prozessumgebung lesen.
An 12 Nachweisstellen beobachtet
Externe Befehle
Kann Befehle oder Programme außerhalb des Skills aufrufen.
An 798 Nachweisstellen beobachtet
Elemente der Fähigkeitsprüfung (352)
Hoch
Node.js child_process module
const cp = require("child_process");
The script imports child_process and later executes local tools used by the render pipeline. This is expected functionality, but it grants the skill external command execution capability.
Hoch
Synchronous file execution
out = cp.execFileSync(
The script calls execFileSync to run tools such as ffmpeg, ffprobe, node, python3, or Hyperframes with project media paths. Argument arrays reduce shell injection risk, but the external execution capability is real.
Hoch
Node.js child_process module
const cp = require("child_process");
The script imports child_process and later executes local tools used by the render pipeline. This is expected functionality, but it grants the skill external command execution capability.
Hoch
Synchronous file execution
cp.execFileSync("node", [path.join(__dirname, "measure-layout.cjs"), project], {
The script calls execFileSync to run tools such as ffmpeg, ffprobe, node, python3, or Hyperframes with project media paths. Argument arrays reduce shell injection risk, but the external execution capability is real.
Hoch
Node.js child_process module
const cp = require("child_process");
The script imports child_process and later executes local tools used by the render pipeline. This is expected functionality, but it grants the skill external command execution capability.
Hoch
Node.js child_process module
const cp2 = require("child_process");
The script imports child_process and later executes local tools used by the render pipeline. This is expected functionality, but it grants the skill external command execution capability.
Hoch
Node.js child_process module
require("child_process").spawnSync(
The script imports child_process and later executes local tools used by the render pipeline. This is expected functionality, but it grants the skill external command execution capability.
Hoch
Synchronous file execution
cp.execFileSync(
The script calls execFileSync to run tools such as ffmpeg, ffprobe, node, python3, or Hyperframes with project media paths. Argument arrays reduce shell injection risk, but the external execution capability is real.
Hoch
Synchronous spawn
let r = cp2.spawnSync("node", [path.join(__dirname, "make-composition.cjs"), project], {
The script calls spawnSync to run local or package-managed tools during transcription, matting, rendering, or validation. This is legitimate for the workflow but remains a real external command risk.
Hoch
Synchronous spawn
cp2.spawnSync(
The script calls spawnSync to run local or package-managed tools during transcription, matting, rendering, or validation. This is legitimate for the workflow but remains a real external command risk.
Hoch
Synchronous spawn
cp2.spawnSync("node", [path.join(__dirname, "make-composition.cjs"), project], {
The script calls spawnSync to run local or package-managed tools during transcription, matting, rendering, or validation. This is legitimate for the workflow but remains a real external command risk.
Hoch
Synchronous spawn
require("child_process").spawnSync(
The script calls spawnSync to run local or package-managed tools during transcription, matting, rendering, or validation. This is legitimate for the workflow but remains a real external command risk.
Hoch
Synchronous spawn
cp2.spawnSync(
The script calls spawnSync to run local or package-managed tools during transcription, matting, rendering, or validation. This is legitimate for the workflow but remains a real external command risk.
Hoch
Synchronous spawn
r = cp2.spawnSync("node", [path.join(__dirname, "make-composition.cjs"), project], {
The script calls spawnSync to run local or package-managed tools during transcription, matting, rendering, or validation. This is legitimate for the workflow but remains a real external command risk.
Hoch
Synchronous spawn
cp2.spawnSync("node", [path.join(__dirname, "measure-layout.cjs"), project, String(midT)], {
The script calls spawnSync to run local or package-managed tools during transcription, matting, rendering, or validation. This is legitimate for the workflow but remains a real external command risk.
Hoch
Synchronous spawn
cp2.spawnSync("node", [path.join(__dirname, "make-composition.cjs"), project], {
The script calls spawnSync to run local or package-managed tools during transcription, matting, rendering, or validation. This is legitimate for the workflow but remains a real external command risk.
Hoch
Node.js child_process module
const cp = require("child_process");
The script imports child_process and later executes local tools used by the render pipeline. This is expected functionality, but it grants the skill external command execution capability.
Hoch
Synchronous file execution
.execFileSync(
The script calls execFileSync to run tools such as ffmpeg, ffprobe, node, python3, or Hyperframes with project media paths. Argument arrays reduce shell injection risk, but the external execution capability is real.
Hoch
Node.js child_process module
const { execFileSync } = require("child_process");
The script imports child_process and later executes local tools used by the render pipeline. This is expected functionality, but it grants the skill external command execution capability.
Hoch
Synchronous file execution
const out = execFileSync(
The script calls execFileSync to run tools such as ffmpeg, ffprobe, node, python3, or Hyperframes with project media paths. Argument arrays reduce shell injection risk, but the external execution capability is real.
Hoch
Synchronous file execution
const D = execFileSync(
The script calls execFileSync to run tools such as ffmpeg, ffprobe, node, python3, or Hyperframes with project media paths. Argument arrays reduce shell injection risk, but the external execution capability is real.
Hoch
Synchronous file execution
const D = execFileSync(
The script calls execFileSync to run tools such as ffmpeg, ffprobe, node, python3, or Hyperframes with project media paths. Argument arrays reduce shell injection risk, but the external execution capability is real.
Hoch
Synchronous file execution
const D = execFileSync(
The script calls execFileSync to run tools such as ffmpeg, ffprobe, node, python3, or Hyperframes with project media paths. Argument arrays reduce shell injection risk, but the external execution capability is real.
Hoch
Synchronous file execution
let D = execFileSync(
The script calls execFileSync to run tools such as ffmpeg, ffprobe, node, python3, or Hyperframes with project media paths. Argument arrays reduce shell injection risk, but the external execution capability is real.
Hoch
Synchronous file execution
let D = execFileSync(
The script calls execFileSync to run tools such as ffmpeg, ffprobe, node, python3, or Hyperframes with project media paths. Argument arrays reduce shell injection risk, but the external execution capability is real.
Hoch
Synchronous file execution
let D = execFileSync(
The script calls execFileSync to run tools such as ffmpeg, ffprobe, node, python3, or Hyperframes with project media paths. Argument arrays reduce shell injection risk, but the external execution capability is real.
Hoch
Node.js child_process module
const cp = require("child_process");
The script imports child_process and later executes local tools used by the render pipeline. This is expected functionality, but it grants the skill external command execution capability.
Hoch
Synchronous file execution
.execFileSync("ffprobe", [
The script calls execFileSync to run tools such as ffmpeg, ffprobe, node, python3, or Hyperframes with project media paths. Argument arrays reduce shell injection risk, but the external execution capability is real.
Hoch
Synchronous file execution
cp.execFileSync(
The script calls execFileSync to run tools such as ffmpeg, ffprobe, node, python3, or Hyperframes with project media paths. Argument arrays reduce shell injection risk, but the external execution capability is real.
Hoch
Synchronous file execution
cp.execFileSync(
The script calls execFileSync to run tools such as ffmpeg, ffprobe, node, python3, or Hyperframes with project media paths. Argument arrays reduce shell injection risk, but the external execution capability is real.
Hoch
Synchronous file execution
cp.execFileSync(
The script calls execFileSync to run tools such as ffmpeg, ffprobe, node, python3, or Hyperframes with project media paths. Argument arrays reduce shell injection risk, but the external execution capability is real.
Hoch
Synchronous spawn
const r = cp.spawnSync("node", [hfCli(), "remove-background", matteSrc, "-o", mov], {
The script calls spawnSync to run local or package-managed tools during transcription, matting, rendering, or validation. This is legitimate for the workflow but remains a real external command risk.
Hoch
Hidden file in home directory
* weights — the model auto-downloads once (~168 MB) to ~/.cache/hyperframes/.
The skill documents or uses hidden cache paths under the user home directory for model weights. This is a real home-directory side effect and should be disclosed and constrained.
Hoch
Symlink creation
fs.symlinkSync(path.basename(found), src);
The script creates symlinks for discovered media or render assets inside the project workflow. This is intended, but symlink handling can redirect file access when run on untrusted project directories.
Hoch
Symlink creation
ln -sf "$p" "$sh/$b"
The script creates symlinks for discovered media or render assets inside the project workflow. This is intended, but symlink handling can redirect file access when run on untrusted project directories.
Hoch
Node.js child_process module
const cp = require("child_process");
The script imports child_process and later executes local tools used by the render pipeline. This is expected functionality, but it grants the skill external command execution capability.
Hoch
Synchronous file execution
cp.execFileSync(
The script calls execFileSync to run tools such as ffmpeg, ffprobe, node, python3, or Hyperframes with project media paths. Argument arrays reduce shell injection risk, but the external execution capability is real.
Hoch
Synchronous file execution
cp.execFileSync("ffmpeg", ["-y", "-i", src, "-vn", "-ac", "1", "-ar", "16000", wav], {
The script calls execFileSync to run tools such as ffmpeg, ffprobe, node, python3, or Hyperframes with project media paths. Argument arrays reduce shell injection risk, but the external execution capability is real.
Hoch
Synchronous file execution
const so = cp.execFileSync("node", [cli, ...args], { encoding: "utf8" });
The script calls execFileSync to run tools such as ffmpeg, ffprobe, node, python3, or Hyperframes with project media paths. Argument arrays reduce shell injection risk, but the external execution capability is real.
Hoch
Synchronous spawn
const r = cp.spawnSync(
The script calls spawnSync to run local or package-managed tools during transcription, matting, rendering, or validation. This is legitimate for the workflow but remains a real external command risk.
Hoch
Synchronous spawn
const r = cp.spawnSync(
The script calls spawnSync to run local or package-managed tools during transcription, matting, rendering, or validation. This is legitimate for the workflow but remains a real external command risk.
Hoch
Synchronous spawn
let r = cp.spawnSync("uvx", wxArgs, { encoding: "utf8", timeout: 600000 });
The script calls spawnSync to run local or package-managed tools during transcription, matting, rendering, or validation. This is legitimate for the workflow but remains a real external command risk.
Hoch
Synchronous spawn
r = cp.spawnSync(
The script calls spawnSync to run local or package-managed tools during transcription, matting, rendering, or validation. This is legitimate for the workflow but remains a real external command risk.
Hoch
Symlink creation
fs.symlinkSync(path.basename(found), src);
The script creates symlinks for discovered media or render assets inside the project workflow. This is intended, but symlink handling can redirect file access when run on untrusted project directories.
Hoch
Hidden file in home directory
- **Node-first; two Python touchpoints via `uvx` (no manual installs):** transcription runs WhisperX
The skill documents or uses hidden cache paths under the user home directory for model weights. This is a real home-directory side effect and should be disclosed and constrained.
Hoch
Hidden file in home directory
- Matting weights are NOT bundled: `matte.cjs` shells the hyperframes CLI's `remove-background`, whi
The skill documents or uses hidden cache paths under the user home directory for model weights. This is a real home-directory side effect and should be disclosed and constrained.
Mittel
Node.js fs operations
fs.writeFileSync(path.join(project, "envelope.json"), JSON.stringify({ hop: HOP, rms }));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
fs.writeFileSync(path.join(project, "envelope.json"), JSON.stringify({ hop: HOP, rms }));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Dynamic require with variable
if (fs.existsSync(c)) return require(c);
The script dynamically requires packages resolved from HYPERFRAMES_ROOT or node_modules paths. This is intended dependency loading, but an attacker-controlled checkout path could affect what code is loaded.
Mittel
Node.js fs operations
for (const d of fs.readdirSync(bun))
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
return JSON.parse(fs.readFileSync(lp, "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
const plan = fs.existsSync(planPath) ? JSON.parse(fs.readFileSync(planPath, "utf8")) : {};
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
return JSON.parse(fs.readFileSync(lp, "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
const plan = fs.existsSync(planPath) ? JSON.parse(fs.readFileSync(planPath, "utf8")) : {};
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
for (const d of fs.readdirSync(bunDir))
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
const html = fs.readFileSync(indexPath, "utf8");
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
const html = fs.readFileSync(indexPath, "utf8");
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
for (const d of fs.readdirSync(bunDir))
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
if (g) gsapSource = fs.readFileSync(g, "utf8");
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
if (g) gsapSource = fs.readFileSync(g, "utf8");
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
const plan = JSON.parse(fs.readFileSync(path.join(project, "plan.json"), "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
const t = JSON.parse(fs.readFileSync(path.join(project, "transcript.json"), "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
const plan = JSON.parse(fs.readFileSync(path.join(project, "plan.json"), "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
const t = JSON.parse(fs.readFileSync(path.join(project, "transcript.json"), "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
plan = JSON.parse(fs.readFileSync(planPath, "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
trWordsRaw = JSON.parse(fs.readFileSync(trPath, "utf8")).words || [];
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.writeFileSync(planPath, JSON.stringify(plan, null, 2));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
plan = JSON.parse(fs.readFileSync(planPath, "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
trWordsRaw = JSON.parse(fs.readFileSync(trPath, "utf8")).words || [];
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
fs.writeFileSync(planPath, JSON.stringify(plan, null, 2));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
plan = JSON.parse(fs.readFileSync(planPath, "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.writeFileSync(planPath, JSON.stringify(plan, null, 2));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
plan = JSON.parse(fs.readFileSync(planPath, "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
fs.writeFileSync(planPath, JSON.stringify(plan, null, 2));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
css = fs.readFileSync(FONTS_CSS, "utf8");
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
html = fs.readFileSync(file, "utf8");
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.writeFileSync(file, html);
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.writeFileSync(file, html);
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
css = fs.readFileSync(FONTS_CSS, "utf8");
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
html = fs.readFileSync(file, "utf8");
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
fs.writeFileSync(file, html);
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
fs.writeFileSync(file, html);
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
return JSON.parse(fs.readFileSync(p, "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
return JSON.parse(fs.readFileSync(p, "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
return JSON.parse(fs.readFileSync(p, "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
return JSON.parse(fs.readFileSync(p, "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
const C = JSON.parse(fs.readFileSync(cj, "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
const tr = (JSON.parse(fs.readFileSync(tj, "utf8")).words || []).filter(
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
sz = JSON.parse(fs.readFileSync(path.join(project, "safe-zones.json"), "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.readdirSync(project).filter((x) => /\.(mp4|mov|webm)$/i.test(x)),
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.writeFileSync(path.join(project, "plan.json"), JSON.stringify(plan, null, 2));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
lay = JSON.parse(fs.readFileSync(path.join(project, "_layout.json"), "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.writeFileSync(path.join(project, "plan.json"), JSON.stringify(plan, null, 2));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.unlinkSync(path.join(project, "_layout.json"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.writeFileSync(path.join(project, "plan.json"), JSON.stringify(plan, null, 2));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
const ss = JSON.parse(fs.readFileSync(path.join(project, "_layout.json"), "utf8")).samples;
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.writeFileSync(path.join(project, "plan.json"), JSON.stringify(plan, null, 2));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.unlinkSync(path.join(project, "_layout.json"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
JSON.parse(fs.readFileSync(path.join(project, "_layout.json"), "utf8")).samples[0].caps ||
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.unlinkSync(path.join(project, "_layout.json"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.writeFileSync(path.join(project, "plan.json"), JSON.stringify(plan, null, 2));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
const C = JSON.parse(fs.readFileSync(cj, "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
const tr = (JSON.parse(fs.readFileSync(tj, "utf8")).words || []).filter(
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
sz = JSON.parse(fs.readFileSync(path.join(project, "safe-zones.json"), "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
fs.writeFileSync(path.join(project, "plan.json"), JSON.stringify(plan, null, 2));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
lay = JSON.parse(fs.readFileSync(path.join(project, "_layout.json"), "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
fs.writeFileSync(path.join(project, "plan.json"), JSON.stringify(plan, null, 2));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
fs.writeFileSync(path.join(project, "plan.json"), JSON.stringify(plan, null, 2));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
const ss = JSON.parse(fs.readFileSync(path.join(project, "_layout.json"), "utf8")).samples;
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
fs.writeFileSync(path.join(project, "plan.json"), JSON.stringify(plan, null, 2));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
JSON.parse(fs.readFileSync(path.join(project, "_layout.json"), "utf8")).samples[0].caps ||
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
fs.writeFileSync(path.join(project, "plan.json"), JSON.stringify(plan, null, 2));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
const plan = JSON.parse(fs.readFileSync(planPath, "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
? fs.readFileSync(path.join(TEMPLATES, "engine.html"), "utf8")
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
: fs.readFileSync(findTemplate(plan.template), "utf8");
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.writeFileSync(path.join(project, "index.html"), src);
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.writeFileSync(path.join(project, "index_fg.html"), fg);
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
const plan = JSON.parse(fs.readFileSync(planPath, "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
? fs.readFileSync(path.join(TEMPLATES, "engine.html"), "utf8")
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
: fs.readFileSync(findTemplate(plan.template), "utf8");
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
fs.writeFileSync(path.join(project, "index.html"), src);
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
fs.writeFileSync(path.join(project, "index_fg.html"), fg);
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Shell command substitution
cd "$(dirname "$0")"
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Template literal with command substitution
`#!/usr/bin/env bash
This JavaScript emits a shell script containing command substitution and interpolated render settings. It is part of the intended post-processing path, but generated shell execution is a real risk surface.
Mittel
Node.js fs operations
const theme = JSON.parse(fs.readFileSync(path.join(PROJECT, "theme.json"), "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
const dna = JSON.parse(fs.readFileSync(path.join(SKILL, "themes", theme.dna + ".json"), "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
const transcript = JSON.parse(fs.readFileSync(path.join(PROJECT, "transcript.json"), "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.readFileSync(path.join(PROJECT, "matte.fps"), "utf8").replace(/\D/g, ""),
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
const n = fs.readdirSync(path.join(PROJECT, "frames_fg")).length;
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
return JSON.parse(fs.readFileSync(p, "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
return JSON.parse(fs.readFileSync(path.join(SKILL, "assets/fonts/char-widths.json"), "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.readFileSync(path.join(SKILL, "assets/brand/cyberpunk-widths.json"), "utf8"),
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
css = fs.readFileSync(path.join(SKILL, "modes/standard/fonts/fonts.css"), "utf8");
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.readFileSync(path.join(SKILL, "assets/brand/cyberpunk-widths.json"), "utf8"),
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.writeFileSync(path.join(PROJECT, "index.html"), bgHtml);
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.writeFileSync(path.join(PROJECT, "rail.html"), fgHtml);
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.unlinkSync(path.join(PROJECT, "rail.html"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.writeFileSync(
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
const theme = JSON.parse(fs.readFileSync(path.join(PROJECT, "theme.json"), "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
const dna = JSON.parse(fs.readFileSync(path.join(SKILL, "themes", theme.dna + ".json"), "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
const transcript = JSON.parse(fs.readFileSync(path.join(PROJECT, "transcript.json"), "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
fs.readFileSync(path.join(PROJECT, "matte.fps"), "utf8").replace(/\D/g, ""),
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
return JSON.parse(fs.readFileSync(p, "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
return JSON.parse(fs.readFileSync(path.join(SKILL, "assets/fonts/char-widths.json"), "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
fs.readFileSync(path.join(SKILL, "assets/brand/cyberpunk-widths.json"), "utf8"),
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
css = fs.readFileSync(path.join(SKILL, "modes/standard/fonts/fonts.css"), "utf8");
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
fs.readFileSync(path.join(SKILL, "assets/brand/cyberpunk-widths.json"), "utf8"),
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
.readFileSync(path.join(SKILL, "assets/brand/CyberpunkReplica.ttf"))
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
fs.writeFileSync(path.join(PROJECT, "index.html"), bgHtml);
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
fs.writeFileSync(path.join(PROJECT, "rail.html"), fgHtml);
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
fs.writeFileSync(
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.symlinkSync(path.basename(found), src);
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.copyFileSync(found, src);
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.mkdirSync(dst, { recursive: true });
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
if (fs.readdirSync(dst).some((f) => f.endsWith(".png"))) return false;
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
return fs.readdirSync(dir).filter((f) => f.endsWith(".png")).length;
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fps = parseInt(fs.readFileSync(fpsFile, "utf8").replace(/\D/g, ""), 10) || 0;
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.writeFileSync(fpsFile, String(fps));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.mkdirSync(framesFg, { recursive: true });
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.rmSync(mov, { force: true });
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.mkdirSync(tmp, { recursive: true });
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.copyFileSync(
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.rmSync(framesFg, { recursive: true, force: true });
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.renameSync(tmp, framesFg);
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.copyFileSync(
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
fps = parseInt(fs.readFileSync(fpsFile, "utf8").replace(/\D/g, ""), 10) || 0;
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
fs.writeFileSync(fpsFile, String(fps));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Hidden file access
* weights — the model auto-downloads once (~168 MB) to ~/.cache/hyperframes/.
The code or documentation references hidden or home-directory cache paths used by the render pipeline. This is expected for model caching but still a real local filesystem side effect.
Mittel
Node.js fs operations
for (const d of fs.readdirSync(bunDir)) {
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
for (const d of fs.readdirSync(bunDir)) {
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
gsapSource = fs.readFileSync(p, "utf8");
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
if (fs.existsSync(planPath)) plan = JSON.parse(fs.readFileSync(planPath, "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
await page.addStyleTag({ content: fs.readFileSync(fontsCss, "utf8") });
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.writeFileSync(outPath, JSON.stringify(layout, null, 2));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
gsapSource = fs.readFileSync(p, "utf8");
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
if (fs.existsSync(planPath)) plan = JSON.parse(fs.readFileSync(planPath, "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
await page.addStyleTag({ content: fs.readFileSync(fontsCss, "utf8") });
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
fs.writeFileSync(outPath, JSON.stringify(layout, null, 2));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Shell command substitution
PROJECT="$(cd "$PROJECT" && pwd)"
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
SD="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Node.js fs operations
for (const d of fs.readdirSync(bunDir))
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
if (g) gsapSource = fs.readFileSync(g, "utf8");
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
await page.addStyleTag({ content: fs.readFileSync(fontsCss, "utf8") });
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
String(fs.readFileSync(path.join(project, "matte.fps"), "utf8")).replace(/[^\d.]/g, ""),
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
JSON.parse(fs.readFileSync(path.join(project, "plan.json"), "utf8")).caption_layer === "fg";
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
const plan = JSON.parse(fs.readFileSync(path.join(project, "plan.json"), "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
? fs.readdirSync(path.join(project, "frames_bg")).length
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.mkdirSync(outDir, { recursive: true });
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
if (g) gsapSource = fs.readFileSync(g, "utf8");
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
await page.addStyleTag({ content: fs.readFileSync(fontsCss, "utf8") });
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
String(fs.readFileSync(path.join(project, "matte.fps"), "utf8")).replace(/[^\d.]/g, ""),
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
JSON.parse(fs.readFileSync(path.join(project, "plan.json"), "utf8")).caption_layer === "fg";
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
const plan = JSON.parse(fs.readFileSync(path.join(project, "plan.json"), "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Shell command substitution
PROJECT="$(cd "$PROJECT" && pwd)"
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
SKILL_SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
for cand in "${2:-}" "${HYPERFRAMES_ROOT:-}" "$(cd "$SKILL_SCRIPT_DIR/../../.." 2>/dev/null && pwd)"
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
C="$(compiler_for)"
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
node "$(dirname "$0")/$C" "$PROJECT"
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
node "$(dirname "$0")/make-cinematic.cjs" "$PROJECT"
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
node "$(dirname "$0")/make-cinematic.cjs" "$PROJECT"
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
C="$(compiler_for)"
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
node "$(dirname "$0")/$C" "$PROJECT"
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
C="$(compiler_for)"
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
ENGINE="$(dirname "$0")/../modes/cinematic/engine.html"
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
if [[ "$(dirname "$0")/$RECOMPILER" -nt "$PROJECT/index.html" || "$(dirname "$0")/lib-dna.cjs" -nt "
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
node "$(dirname "$0")/$RECOMPILER" "$PROJECT"
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
node "$(dirname "$0")/inject-fonts.cjs" "$PROJECT" \
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
if ! node "$(dirname "$0")/check-timing.cjs" "$PROJECT" --strict; then
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
node "$(dirname "$0")/check-occlusion.cjs" "$PROJECT" --strict > "$OCC_LOG" 2>&1 &
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
if [[ ! -f "$PROJECT/plan.json" && -f "$PROJECT/index.html" && -f "$(dirname "$0")/check-overflow.cj
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
node "$(dirname "$0")/check-overflow.cjs" "$PROJECT" \
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
if [[ -f "$PROJECT/rail.html" && -f "$(dirname "$0")/check-overflow.cjs" ]]; then
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
if node "$(dirname "$0")/check-overflow.cjs" "$PROJECT" rail.html; then
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
if [[ -f "$PROJECT/rail.html" && -f "$PROJECT/index.html" && -f "$(dirname "$0")/check-rail-climax.c
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
if ! node "$(dirname "$0")/check-rail-climax.cjs" "$PROJECT"; then
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
FPS="$(tr -dc '0-9' < "$PROJECT/matte.fps")"
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
PFPS="$(node -e 'try{process.stdout.write(String(require(process.argv[1]).fps??""))}catch(e){}' "$PR
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
FPS="$(node -e 'process.stdout.write(String(require(process.argv[1]).fps??24))' "$PROJECT/plan.json"
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
N="$(ls "$PROJECT/frames_fg" | wc -l | tr -d ' ')"
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
DUR="$(grep -oE 'data-duration="[0-9.]+"' "$PROJECT/index.html" | head -1 | grep -oE '[0-9.]+' || ec
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
FPS="$(awk "BEGIN{printf \"%d\", $N/$DUR + 0.5}")"
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
CAPTION_LAYER="$(node -e 'process.stdout.write(String(require(process.argv[1]).caption_layer??"bg"))
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
ATTR="$(grep -oE 'data-caption-layer="(bg|fg)"' "$PROJECT/index.html" | head -1 | grep -oE '(bg|fg)'
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
STAMP="$(date +%Y%m%d-%H%M%S)"
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
N_FRAMES="$(ls "$PROJECT/frames_fg" 2>/dev/null | wc -l | tr -d ' ')"
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
HF_TIMEOUT_S="${HF_TIMEOUT_S:-$(( N_FRAMES * 3 / 2 > 240 ? N_FRAMES * 3 / 2 : 240 ))}"
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
elapsed=$((SECONDS - start))
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
[[ -f "$out" ]] && sz=$(stat -f%z "$out" 2>/dev/null || echo 0)
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
b="$(basename "$p")"
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
W="$(ffprobe -v error -select_streams v:0 -show_entries stream=width -of default=nw=1:nk=1 "$BG")"
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
H="$(ffprobe -v error -select_streams v:0 -show_entries stream=height -of default=nw=1:nk=1 "$BG")"
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
MATTE_DUR="$(awk "BEGIN{printf \"%.3f\", $(ls "$PROJECT/frames_fg" | wc -l)/$FPS}")"
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
SRC_DUR="$(ffprobe -v error -show_entries format=duration -of csv=p=0 "$PROJECT/source.mp4" 2>/dev/n
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
MATTE_DUR="$(awk "BEGIN{m=$MATTE_DUR; s=$SRC_DUR; printf \"%.3f\", (s>0 && s<m) ? s : m}")"
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
BG_DUR="$(ffprobe -v error -show_entries format=duration -of default=nokey=1:noprint_wrappers=1 "$BG
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Template literal with command substitution
# bash 3.2 (macOS) throws on empty-array expansion under `set -u`, so branch
This JavaScript emits a shell script containing command substitution and interpolated render settings. It is part of the intended post-processing path, but generated shell execution is a real risk surface.
Mittel
Shell command substitution
PROJECT="$(cd "$PROJECT" && pwd)"
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Shell command substitution
SD="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
The shell script or generated post-processing script uses command substitution for path resolution and render setup. The usage is mostly bounded, but it is real shell evaluation during installation or rendering.
Mittel
Dynamic require with variable
sharp = require(c);
The script dynamically requires packages resolved from HYPERFRAMES_ROOT or node_modules paths. This is intended dependency loading, but an attacker-controlled checkout path could affect what code is loaded.
Mittel
Node.js fs operations
for (const d of fs.readdirSync(bunDir))
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
words = (JSON.parse(fs.readFileSync(tp, "utf8")).words || []).filter((w) => w && "start" in w);
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
String(fs.readFileSync(path.join(project, "matte.fps"), "utf8")).replace(/[^\d.]/g, ""),
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.writeFileSync(path.join(project, "safe-zones.json"), JSON.stringify(out, null, 2));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
words = (JSON.parse(fs.readFileSync(tp, "utf8")).words || []).filter((w) => w && "start" in w);
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
String(fs.readFileSync(path.join(project, "matte.fps"), "utf8")).replace(/[^\d.]/g, ""),
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
fs.writeFileSync(path.join(project, "safe-zones.json"), JSON.stringify(out, null, 2));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.symlinkSync(path.basename(found), src);
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.copyFileSync(found, src);
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
const d = JSON.parse(fs.readFileSync(out, "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.mkdirSync(outDir, { recursive: true });
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
const wxJson = JSON.parse(fs.readFileSync(path.join(outDir, "_wx_audio.json"), "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.unlinkSync(wav);
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
const flat = JSON.parse(fs.readFileSync(flatPath, "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Node.js fs operations
fs.writeFileSync(
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
const d = JSON.parse(fs.readFileSync(out, "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
const wxJson = JSON.parse(fs.readFileSync(path.join(outDir, "_wx_audio.json"), "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
const flat = JSON.parse(fs.readFileSync(flatPath, "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Mittel
Synchronous file operations
fs.writeFileSync(
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Hardcoded URL
<script src="https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js"></script>
The template or generated HTML references a jsDelivr CDN URL for GSAP, which can cause outbound network requests during preview or render. The dependency should be bundled or pinned locally for marketplace use.
Niedrig
Hardcoded URL
<script src="https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js"></script>
The template or generated HTML references a jsDelivr CDN URL for GSAP, which can cause outbound network requests during preview or render. The dependency should be bundled or pinned locally for marketplace use.
Niedrig
Hardcoded URL
<script src="https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js"></script>
The template or generated HTML references a jsDelivr CDN URL for GSAP, which can cause outbound network requests during preview or render. The dependency should be bundled or pinned locally for marketplace use.
Niedrig
Hardcoded URL
<script src="https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js"></script>
The template or generated HTML references a jsDelivr CDN URL for GSAP, which can cause outbound network requests during preview or render. The dependency should be bundled or pinned locally for marketplace use.
Niedrig
Hardcoded URL
<script src="https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js"></script>
The template or generated HTML references a jsDelivr CDN URL for GSAP, which can cause outbound network requests during preview or render. The dependency should be bundled or pinned locally for marketplace use.
Niedrig
Hardcoded URL
<script src="https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js"></script>
The template or generated HTML references a jsDelivr CDN URL for GSAP, which can cause outbound network requests during preview or render. The dependency should be bundled or pinned locally for marketplace use.
Niedrig
Hardcoded URL
<script src="https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js"></script>
The template or generated HTML references a jsDelivr CDN URL for GSAP, which can cause outbound network requests during preview or render. The dependency should be bundled or pinned locally for marketplace use.
Niedrig
Hardcoded URL
<script src="https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js"></script>
The template or generated HTML references a jsDelivr CDN URL for GSAP, which can cause outbound network requests during preview or render. The dependency should be bundled or pinned locally for marketplace use.
Niedrig
Node.js fs stat operations
if (fs.existsSync(p)) return p;
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (fs.existsSync(bun))
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (fs.existsSync(c)) return require(c);
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
let stale = force || !fs.existsSync(lp);
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (!stale && fs.existsSync(idx) && fs.statSync(idx).mtimeMs > fs.statSync(lp).mtimeMs)
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (!fs.existsSync(png)) return null;
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (!fs.existsSync(framesDir)) {
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
const plan = fs.existsSync(planPath) ? JSON.parse(fs.readFileSync(planPath, "utf8")) : {};
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Environment variable access (dot notation)
process.env.HYPERFRAMES_ROOT,
The script reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose tool paths, engines, or package versions. No exfiltration is evident, but environment-controlled execution is a real configuration risk.
Niedrig
Environment variable object
process.env.HYPERFRAMES_ROOT,
The script reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose tool paths, engines, or package versions. No exfiltration is evident, but environment-controlled execution is a real configuration risk.
Niedrig
Node.js fs stat operations
if (fs.existsSync(bunDir)) {
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (fs.existsSync(p)) {
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (!fs.existsSync(indexPath)) {
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
executablePath: fs.existsSync(exe) ? exe : undefined,
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Environment variable access (dot notation)
process.env.HYPERFRAMES_ROOT,
The script reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose tool paths, engines, or package versions. No exfiltration is evident, but environment-controlled execution is a real configuration risk.
Niedrig
Environment variable object
process.env.HYPERFRAMES_ROOT,
The script reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose tool paths, engines, or package versions. No exfiltration is evident, but environment-controlled execution is a real configuration risk.
Niedrig
Node.js fs stat operations
if (fs.existsSync(bunDir))
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (fs.existsSync(p)) return p;
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (!fs.existsSync(railPath) || !fs.existsSync(indexPath))
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
executablePath: fs.existsSync(exe) ? exe : undefined,
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Environment variable access (dot notation)
process.env.HYPERFRAMES_ROOT,
The script reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose tool paths, engines, or package versions. No exfiltration is evident, but environment-controlled execution is a real configuration risk.
Niedrig
Environment variable object
process.env.HYPERFRAMES_ROOT,
The script reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose tool paths, engines, or package versions. No exfiltration is evident, but environment-controlled execution is a real configuration risk.
Niedrig
Node.js fs stat operations
if (!fs.existsSync(p)) {
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (!fs.existsSync(cj)) die(`missing ${cj} — author it first (schema in this header)`);
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (!fs.existsSync(tj)) die(`missing ${tj} — run prepare.sh first`);
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (!fs.existsSync(fp)) continue;
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (!fs.existsSync(p)) continue;
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (fs.existsSync(p)) return p;
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
.filter((d) => fs.existsSync(path.join(TEMPLATES, d, "template.html")))
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (!fs.existsSync(planPath)) {
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Hardcoded URL
const GSAP = `<script src="https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js" integrity="sha
The template or generated HTML references a jsDelivr CDN URL for GSAP, which can cause outbound network requests during preview or render. The dependency should be bundled or pinned locally for marketplace use.
Niedrig
Node.js fs stat operations
} else if (fs.existsSync(path.join(PROJECT, "rail.html"))) {
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (fs.existsSync(cli)) return cli;
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (!fs.existsSync(src)) {
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (!fs.existsSync(src)) {
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (!fs.existsSync(cfr)) {
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
const cached = fs.existsSync(
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (r.status !== 0 || !fs.existsSync(mov)) {
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Environment variable access (dot notation)
process.env.HYPERFRAMES_ROOT,
The script reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose tool paths, engines, or package versions. No exfiltration is evident, but environment-controlled execution is a real configuration risk.
Niedrig
Environment variable object
process.env.HYPERFRAMES_ROOT,
The script reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose tool paths, engines, or package versions. No exfiltration is evident, but environment-controlled execution is a real configuration risk.
Niedrig
Node.js fs stat operations
if (fs.existsSync(bunDir)) {
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (fs.existsSync(p)) {
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (fs.existsSync(bunDir)) {
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (fs.existsSync(p)) {
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (!fs.existsSync(indexPath)) {
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (fs.existsSync(planPath)) plan = JSON.parse(fs.readFileSync(planPath, "utf8"));
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
executablePath: fs.existsSync(exe) ? exe : undefined,
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (fs.existsSync(fontsCss))
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Environment variable access (dot notation)
process.env.HYPERFRAMES_ROOT,
The script reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose tool paths, engines, or package versions. No exfiltration is evident, but environment-controlled execution is a real configuration risk.
Niedrig
Environment variable object
process.env.HYPERFRAMES_ROOT,
The script reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose tool paths, engines, or package versions. No exfiltration is evident, but environment-controlled execution is a real configuration risk.
Niedrig
Node.js fs stat operations
if (fs.existsSync(bunDir))
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (fs.existsSync(p)) return p;
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (fs.existsSync(fontsCss))
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (!fs.existsSync(idx)) {
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
const hasRail = fs.existsSync(railP);
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
const hasFg = fs.existsSync(fgP); // hybrid: fg caps render ABOVE the matte (like the real composite
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
const n = fs.existsSync(path.join(project, "frames_bg"))
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
executablePath: fs.existsSync(exe) ? exe : undefined,
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (!fs.existsSync(bg)) {
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (!globalFg && fs.existsSync(fg)) layers.push({ input: fg }); // subject occludes embed
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Environment variable access (dot notation)
process.env.HYPERFRAMES_ROOT,
The script reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose tool paths, engines, or package versions. No exfiltration is evident, but environment-controlled execution is a real configuration risk.
Niedrig
Environment variable object
process.env.HYPERFRAMES_ROOT,
The script reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose tool paths, engines, or package versions. No exfiltration is evident, but environment-controlled execution is a real configuration risk.
Niedrig
Node.js fs stat operations
if (fs.existsSync(bunDir))
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (fs.existsSync(c)) {
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (!fs.existsSync(tp)) return [];
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (!fs.existsSync(fgDir)) {
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
const hasBg = fs.existsSync(bgDir);
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (hasBg && fs.existsSync(path.join(bgDir, frames[i]))) {
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (hasBg && fs.existsSync(midBg)) {
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Environment variable access (dot notation)
process.env.HYPERFRAMES_ROOT,
The script reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose tool paths, engines, or package versions. No exfiltration is evident, but environment-controlled execution is a real configuration risk.
Niedrig
Environment variable object
process.env.HYPERFRAMES_ROOT,
The script reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose tool paths, engines, or package versions. No exfiltration is evident, but environment-controlled execution is a real configuration risk.
Niedrig
Node.js fs stat operations
if (fs.existsSync(path.join(r, "packages", "cli", "dist", "cli.js"))) return r;
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (fs.existsSync(src)) return src;
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
let found = cands.sort((a, b) => fs.statSync(b).size - fs.statSync(a).size)[0];
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (!fs.existsSync(src)) {
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Node.js fs stat operations
if (!fs.existsSync(audio))
The script reads, writes, stats, copies, or removes files under the user-supplied project and generated render artifacts. This is expected for video rendering but is real filesystem access.
Niedrig
Environment variable access (dot notation)
process.env.HYPERFRAMES_ROOT,
The script reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose tool paths, engines, or package versions. No exfiltration is evident, but environment-controlled execution is a real configuration risk.
Niedrig
Environment variable access (dot notation)
const model = process.argv[3] || process.env.WHISPER_MODEL || "small";
The script reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose tool paths, engines, or package versions. No exfiltration is evident, but environment-controlled execution is a real configuration risk.
Niedrig
Environment variable access (dot notation)
const language = process.argv[4] || process.env.WHISPER_LANG || "";
The script reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose tool paths, engines, or package versions. No exfiltration is evident, but environment-controlled execution is a real configuration risk.
Niedrig
Environment variable access (dot notation)
const wantWx = (process.env.TRANSCRIBE_ENGINE || "whisperx") === "whisperx";
The script reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose tool paths, engines, or package versions. No exfiltration is evident, but environment-controlled execution is a real configuration risk.
Niedrig
Environment variable access (dot notation)
const whisperxSpec = `whisperx==${process.env.WHISPERX_VERSION || "3.8.6"}`;
The script reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose tool paths, engines, or package versions. No exfiltration is evident, but environment-controlled execution is a real configuration risk.
Niedrig
Environment variable object
process.env.HYPERFRAMES_ROOT,
The script reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose tool paths, engines, or package versions. No exfiltration is evident, but environment-controlled execution is a real configuration risk.
Niedrig
Environment variable object
const model = process.argv[3] || process.env.WHISPER_MODEL || "small";
The script reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose tool paths, engines, or package versions. No exfiltration is evident, but environment-controlled execution is a real configuration risk.
Niedrig
Environment variable object
const language = process.argv[4] || process.env.WHISPER_LANG || "";
The script reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose tool paths, engines, or package versions. No exfiltration is evident, but environment-controlled execution is a real configuration risk.
Niedrig
Environment variable object
const wantWx = (process.env.TRANSCRIBE_ENGINE || "whisperx") === "whisperx";
The script reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose tool paths, engines, or package versions. No exfiltration is evident, but environment-controlled execution is a real configuration risk.
Niedrig
Environment variable object
const whisperxSpec = `whisperx==${process.env.WHISPERX_VERSION || "3.8.6"}`;
The script reads environment variables such as HYPERFRAMES_ROOT or WHISPER settings to choose tool paths, engines, or package versions. No exfiltration is evident, but environment-controlled execution is a real configuration risk.
Risikofunde
Bestätigte Sicherheitsbedenken werden von Punkten getrennt, die noch überprüft werden müssen.
Bestätigte Sicherheitsbedenken (2)
RISK-001 Hoch
Runtime Package and Model Downloads
The skill documentation and scripts state that WhisperX can be run through uvx and that matting weights can download into the user cache on first run. This is legitimate functionality, but it creates a network and supply-chain risk not fully represented by simple URL scans.
The docs explicitly mention uvx transcription and model downloads, and transcribe.cjs builds a uvx WhisperX invocation. This is direct evidence of runtime package or model resolution.
RISK-002 Niedrig
Unscanned file (too_large) — manual review required
[unscanned: too_large]
The file was not statically scanned because it is binary or oversized. The asset appears to be a font resource, but opaque bundled content still needs provenance and manual review.
Abhilfemaßnahmen
Von diesem Audit vorgeschlagene Korrekturen wurden erfasst. Ihre Umsetzung liegt in der Verantwortung des Maintainers.
- FIX-001HochThe workflow executes ffmpeg, ffprobe, node, uvx, python3, and Hyperframes commands.Document the exact command allowlist, validate project paths, avoid shell interpolation, and fail closed when required binaries are missing.
- FIX-002HochRuntime package and model downloads can occur on first use.Pin package and model versions with checksums, disclose downloads before execution, and support an offline preflight mode.
- FIX-003HochThe scripts create symlinks and operate on user-supplied project directories.Restrict operations to the selected project root, reject path escapes, and avoid following untrusted symlinks when reading or writing artifacts.
- FIX-004MittelGenerated HTML loads GSAP from a CDN.Bundle GSAP locally with the skill or vendor it through the approved renderer dependency path with integrity checks.
- FIX-005NiedrigBundled binary font assets could not be statically scanned.Provide source, license, and checksum provenance for each binary font, or replace them with text-based audited assets where practical.
Expertennachweise
Unveränderliche Subjektidentität, Scanner-Metadaten, verworfene Treffer und Nachweise auf Quellcodeebene.
Artefakt-Subjekt
- Marketplace-Commit
- Nicht verfügbar
- Inhalts-Hash
- Nicht verfügbar
- Tree-Hash
- Nicht verfügbar
- Skill-Pfad
- Nicht verfügbar
- Hash der Audit-Nutzlast
- Nicht verfügbar
Analysemetadaten
Auditmodell: codex
Analysestatus: Vollständig
Der Umfang ist auf die aufgezeichneten Dateien, Zeilen, Methoden und Nachweise beschränkt. Es wird keine Ausführung in einer Laufzeitumgebung oder Sandbox beansprucht.
Verifizieren und exportieren
Das Manifest und die Lockdatei binden Installationsartefakte an kryptografische Hashes. Diese Integritätsaussage ist von der Sicherheitsbewertung getrennt.
Audit-Nachweis: not_attestable