Skills contribute-catalog

📦

contribute-catalog

Name: contribute-catalog
Author: heygen-com

Content revision r1 Medium Risk ⚙️ External commands🌐 Network access

Contribute HyperFrames Catalog Items

Creating a reusable HyperFrames catalog item requires structure, metadata, previews, and review steps. This skill guides contributors from idea to validated pull request.

Supports: Claude Codex Code(CC)

⚠️ 50 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "contribute-catalog" from https://skillstore.io/skills/heygen-com-contribute-catalog.md and its manifest at https://skillstore.io/api/skills/heygen-com-contribute-catalog/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/heygen-com-contribute-catalog.md Signed manifest GET /api/skills/heygen-com-contribute-catalog/manifest Signed lockfile GET /api/skills/heygen-com-contribute-catalog/lockfile

Test it

Using "contribute-catalog". I want to add a bold karaoke caption style for social videos.

Expected outcome:

The skill identifies this as a block, proposes a registry location, lists caption readability rules, and prepares validation and preview tasks.

Using "contribute-catalog". I built a shimmer overlay and want it in the public catalog.

Expected outcome:

The skill classifies it as a component, checks naming and metadata needs, and describes how to package it for review.

Using "contribute-catalog". Before I open the pull request, check what I missed.

Expected outcome:

The skill produces a submission checklist covering linting, validation, formatting, registry updates, generated docs, preview assets, and pull request details.

Security Audit

Medium Risk

v4 • 7/5/2026 Open versioned report

Most static Ruby backtick detections are Markdown, JSON, or JavaScript template false positives rather than shell execution. Real risks remain around documented CLI execution, publishing, GitHub actions, AWS upload guidance, and third-party CDN resources. No evidence found for prompt injection or covert data-exfiltration intent.

Files scanned

630

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

Medium

SKILL.md:164

Cloud Credential Upload Workflow

SKILL.md directs internal contributors to run scripts/upload-docs-images.sh with the AWS profile engineering-767398024897. This could upload assets using cloud credentials if an agent runs it without explicit approval.

The instruction explicitly names an upload script and AWS profile. The context says it is for internal contributors, so the risk is controlled but real.

Medium

SKILL.md:186-197

External Publication Workflow

SKILL.md includes a shipping flow that publishes to hyperframes.dev, pushes a branch, and creates a GitHub pull request. These commands change external state and should not run without user confirmation.

The listed steps explicitly publish, push, and create a pull request. The behavior matches the contribution purpose, but it has external side effects.

Capability review items (14)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:144-147

Ruby/shell backtick execution

```bash

The fenced bash section tells the agent to run local HyperFrames lint and validate commands. The commands are expected for this workflow but still execute tools in the user workspace.

Medium

SKILL.md:151-160

Ruby/shell backtick execution

```bash

This preview section directs rendering snapshots and running npx hyperframes publish. It can execute local tooling and publish externally, so it requires user approval.

Medium

SKILL.md:164

Ruby/shell backtick execution

- **HeyGen internal contributors:** run `scripts/upload-docs-images.sh` (requires AWS profile `engin

The line instructs internal contributors to run an upload script using a named AWS profile. That is a real command with cloud-side effects if executed.

Medium

SKILL.md:173-198

Ruby/shell backtick execution

```bash

The shipping block includes git, npx, publish, push, and gh pr create commands. These can modify files and remote state, so they are real external command risks.

Medium

SKILL.md:200-204

Ruby/shell backtick execution

**If you don't have a GitHub account:** you need one to open a PR. Sign up at https://github.com/sig

The paragraph tells users to run gh auth login for GitHub access. This is expected for pull requests but invokes an external authentication command.

Medium

SKILL.md:204-205

Ruby/shell backtick execution

- [ ] `hyperframes lint` → 0 errors

The quality gate requires running hyperframes lint and validate commands. These are bounded project checks but still execute external CLI tooling.

Medium

SKILL.md:205-206

Ruby/shell backtick execution

- [ ] `hyperframes validate` → 0 console errors

The quality gate includes hyperframes validate and adjacent npx checks. The usage is legitimate validation, but it is still command execution in the repository.

Medium

SKILL.md:206-207

Ruby/shell backtick execution

- [ ] `npx oxfmt --check` passes

The checklist requires npx oxfmt --check. npx execution is expected here but can invoke local or package-managed tooling.

Medium

SKILL.md:208-209

Ruby/shell backtick execution

- [ ] `scripts/generate-catalog-pages.ts` run (docs page generated)

The checklist requires running the catalog generation script and the publish command. These can modify generated docs and publish a project URL.

Low

templates.md:13

Hardcoded URL

href="https://fonts.googleapis.com/css2?family=Montserrat:wght@800;900&display=swap"

The template loads Google Fonts from an external URL. This is visible and common, but generated pages will contact a third-party service.

Low

templates.md:16

Hardcoded URL

The caption template loads GSAP from jsDelivr. The version is pinned, but it still executes third-party browser code without an integrity attribute.

Low

templates.md:191

Hardcoded URL

The VFX template loads GSAP from jsDelivr. The version is pinned, but it still executes third-party browser code without an integrity attribute.

Low

templates.md:192

Hardcoded URL

The VFX template loads Three.js from jsDelivr. The version is pinned, but it still executes third-party browser code without an integrity attribute.

Low

templates.md:377

Hardcoded URL

The component template loads GSAP from jsDelivr. The version is pinned, but it still executes third-party browser code without an integrity attribute.

Risk Factors

⚙️ External commands (49)

🌐 Network access (10)

SKILL.md:63 SKILL.md:85 SKILL.md:200 templates.md:13 templates.md:16 templates.md:191 templates.md:192 templates.md:322 templates.md:344 templates.md:377

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/heygen-com-contribute-catalog/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/heygen-com-contribute-catalog/security.svg)](https://skillstore.io/skills/heygen-com-contribute-catalog?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/heygen-com-contribute-catalog?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/heygen-com-contribute-catalog/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/heygen-com-contribute-catalog.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

heygen-com. (2026). contribute-catalog security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/heygen-com-contribute-catalog/audits/4

BibTeX citation

@techreport{heygen-com-heygen-com-contribute-catalog-2026,
  author = {heygen-com},
  title = {contribute-catalog security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/heygen-com-contribute-catalog/audits/4},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "contribute-catalog security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
  - name: "heygen-com"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/heygen-com-contribute-catalog/audits/4"
identifiers:
  - type: other
    value: "skillstore:heygen-com-contribute-catalog:audit:4"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Submit a Caption Style

Build a new caption block with readable text, timed word highlights, metadata, previews, and validation steps.

Create a VFX Block

Prepare a Three.js-based visual effect with deterministic animation and catalog-ready preview assets.

Review a Registry Addition

Check whether a proposed catalog item follows naming, metadata, validation, and publishing requirements.

Try These Prompts

Start a Catalog Idea

Help me contribute a HyperFrames catalog item. Ask what you need to know before choosing block or component.

Scaffold a New Block

Create the folder plan, metadata checklist, and implementation steps for a new HyperFrames block named [name].

Adapt a Template

Use the appropriate HyperFrames contribution template for a [caption, VFX, or component] item and explain what I must replace.

Prepare for Pull Request

Review my catalog contribution plan and list the validation, preview, publish, and pull request steps I must complete.

Best Practices

Confirm the item type before creating files or metadata.
Run validation and preview steps before asking maintainers to review.
Ask before running commands that publish, push, authenticate, or upload assets.

Avoid

Using the contribution workflow for private in-project edits.
Submitting an item without preview media or generated catalog documentation.
Running publish, GitHub, or cloud upload commands without explicit user approval.

Frequently Asked Questions

Is this skill for using existing catalog items?

No. It is for contributing new public catalog blocks or components.

What is the difference between a block and a component?

A block is a complete composition with dimensions and duration. A component is a reusable snippet inside another composition.

Does it generate preview assets automatically?

It explains the preview workflow. The user still needs local tools and approval for publishing or uploads.

Can it help with captions?

Yes. It includes caption rules for readability, timing, karaoke highlights, and overflow handling.

Can it help with Three.js effects?

Yes. It provides VFX guidance for deterministic rendering and timeline-controlled animation.

Does it open the pull request for me?

It lists the pull request steps. Commands that push or create a pull request should require explicit confirmation.

Developer Details

Author

heygen-com

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/heygen-com/hyperframes/tree/main/skills/contribute-catalog/

Ref

30c73eac2afe762f6aa9c4553158769369d47351

Maintenance freshness

7/18/2026

Usage

1 downloads · 0 views

File structure

📄 SKILL.md

📄 templates.md