Skills hyperframes-animation

📦

hyperframes-animation

Name: hyperframes-animation
Author: heygen-com

Content revision r2 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access⚡ Contains scripts🔑 Env variables

Create Deterministic HyperFrames Animations

Building multi-phase animation scenes can require many timing and runtime decisions. This skill provides focused motion recipes, blueprints, and an animation-map review workflow for HyperFrames projects.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "hyperframes-animation" from https://skillstore.io/skills/heygen-com-hyperframes-animation.md and its manifest at https://skillstore.io/api/skills/heygen-com-hyperframes-animation/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/heygen-com-hyperframes-animation.md Signed manifest GET /api/skills/heygen-com-hyperframes-animation/manifest Signed lockfile GET /api/skills/heygen-com-hyperframes-animation/lockfile

Test it

Using "hyperframes-animation". Create a short product metric reveal.

Expected outcome:

Suggested sequence: card entry, metric count-up, then a brief emphasis on the result.
Timeline notes: use one paused timeline and explicit labels for each phase.

Using "hyperframes-animation". Review an existing composition.

Expected outcome:

Animation-map workflow: generate a local report from registered GSAP timelines.
Review focus: long inactive intervals, inconsistent staggers, and unusually short tweens.

Security Audit

High Risk

v5 • 7/19/2026 Open versioned report

Most static matches are false positives caused by animation documentation, JavaScript template literals, example URLs, and test utilities. The audit confirmed a dependency-provenance risk: environment-controlled module search paths feed a dynamic import, and the fallback bootstrap can install @latest. No prompt injection, secret collection, covert exfiltration, or screen-capture upload behavior was found. Static review was capped at 400/648 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

102

Files scanned

25,346

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

High

scripts/package-loader.mjs:221

Environment file access

return (process.env[NODE_MODULES_ENV] ?? "").split(delimiter).filter(Boolean);

This environment variable controls directories searched for module resolution. Its value can influence which JavaScript module is dynamically imported.

High

scripts/package-loader.mjs:226

Environment file access

for (const entry of (process.env.PATH ?? "").split(delimiter)) {

PATH-derived node_modules directories participate in module resolution before dynamic import. A manipulated environment can redirect execution to an attacker-controlled local package.

High

scripts/package-loader.mjs:148-159

Unpinned fallback dependency bootstrap

When the bundled package version cannot be discovered, the loader falls back to @latest before a temporary npm install. This weakens the stated pinned-spec protection and permits an unexpected package version to execute after installation.

The code explicitly returns an @latest package spec in this fallback path, while the file comments describe pinned specifications as a security control.

Capability review items (5)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

scripts/package-loader.mjs:54

Dynamic import() expression

modules[packageName] = await import(pathToFileURL(entry).href);

The loader dynamically imports a module entry resolved from configured directories. A malicious package placed in a trusted-by-process module location would execute in the local Node process.

Low

scripts/package-loader.mjs:221

Environment variable access (bracket notation)

return (process.env[NODE_MODULES_ENV] ?? "").split(delimiter).filter(Boolean);

This environment variable controls directories searched for module resolution. Its value can influence which JavaScript module is dynamically imported.

Low

scripts/package-loader.mjs:226

Environment variable access (dot notation)

for (const entry of (process.env.PATH ?? "").split(delimiter)) {

PATH-derived node_modules directories participate in module resolution before dynamic import. A manipulated environment can redirect execution to an attacker-controlled local package.

Low

scripts/package-loader.mjs:221

Environment variable object

return (process.env[NODE_MODULES_ENV] ?? "").split(delimiter).filter(Boolean);

This environment variable controls directories searched for module resolution. Its value can influence which JavaScript module is dynamically imported.

Low

scripts/package-loader.mjs:226

Environment variable object

for (const entry of (process.env.PATH ?? "").split(delimiter)) {

PATH-derived node_modules directories participate in module resolution before dynamic import. A manipulated environment can redirect execution to an attacker-controlled local package.

Risk Factors

⚙️ External commands (50)

adapters/animate-text.md:57-58 adapters/animate-text.md:58-59 adapters/animate-text.md:59-60 adapters/html-in-canvas-patterns.md:104-127 adapters/html-in-canvas-patterns.md:168-171 adapters/html-in-canvas-patterns.md:192-217 adapters/html-in-canvas-patterns.md:301-307 adapters/html-in-canvas-patterns.md:308-315 examples/brand-reveal-assemble-zoom.html:252 examples/concept-demo-decode-pan.html:18 examples/concept-demo-decode-pan.html:321 examples/cta-orbit-collapse.html:302 examples/cta-orbit-collapse.html:363 examples/cta-orbit-collapse.html:430 examples/cta-orbit-collapse.html:941 examples/cta-orbit-collapse.html:942 examples/cta-orbit-collapse.html:974 examples/cta-orbit-collapse.html:999 examples/cta-orbit-collapse.html:1017 examples/cta-orbit-collapse.html:1061 examples/cta-orbit-collapse.html:1062 examples/cta-orbit-collapse.html:1238 examples/demo-page-scroll-spotlight.html:645 examples/demo-page-scroll-spotlight.html:646 examples/hook-counter-burst.html:465 examples/hook-counter-burst.html:502 examples/messaging-multi-phrase.html:32 examples/messaging-multi-phrase.html:38 examples/messaging-multi-phrase.html:39 examples/messaging-multi-phrase.html:96 examples/problem-mockup-overwhelm.html:28 examples/problem-mockup-overwhelm.html:30 examples/problem-mockup-overwhelm.html:37 examples/problem-mockup-overwhelm.html:38 examples/proof-logo-chain.html:581 examples/takeover-ticker-displace.html:264 examples/takeover-ticker-displace.html:274 examples/workflow-approve-press.html:583 examples/workflow-approve-press.html:586 rules/3d-text-depth-layers.md:86-93 rules/3d-text-depth-layers.md:93-94 rules/3d-text-depth-layers.md:94-136 rules/3d-text-depth-layers.md:136-145 rules/3d-text-depth-layers.md:177-183 rules/3d-text-depth-layers.md:190-191 rules/ai-tracking-box.md:156-184 rules/ai-tracking-box.md:184-185 rules/ai-tracking-box.md:185-192 rules/ai-tracking-box.md:192-193 rules/ai-tracking-box.md:193-194

🌐 Network access (50)

adapters/animejs.md:23 adapters/animejs.md:74 adapters/gsap.md:15 adapters/html-in-canvas-patterns.md:133 adapters/html-in-canvas-patterns.md:134 adapters/html-in-canvas-patterns.md:135 adapters/html-in-canvas-patterns.md:136 adapters/html-in-canvas-patterns.md:137 adapters/lottie.md:24 adapters/lottie.md:50 adapters/three.md:26 adapters/three.md:75 adapters/three.md:76 examples/brand-reveal-assemble-zoom.html:28 examples/comparison-split-cards.html:28 examples/concept-demo-decode-pan.html:23 examples/cta-morph-press.html:30 examples/cta-orbit-collapse.html:62 examples/demo-page-scroll-spotlight.html:28 examples/hook-counter-burst.html:34 examples/messaging-multi-phrase.html:43 examples/metric-video-text-pivot.html:34 examples/problem-mockup-overwhelm.html:48 examples/proof-logo-chain.html:29 examples/takeover-ticker-displace.html:25 examples/workflow-approve-press.html:34 rules/3d-page-scroll.md:108 rules/3d-text-depth-layers.md:78 rules/ai-tracking-box.md:137 rules/ambient-glow-bloom.md:118 rules/asr-keyword-glow.md:90 rules/avatar-cloud-network.md:148 rules/camera-cursor-tracking.md:108 rules/card-morph-anchor.md:107 rules/center-outward-expansion.md:87 rules/context-sensitive-cursor.md:85 rules/coordinate-target-zoom.md:180 rules/counting-dynamic-scale.md:108 rules/cursor-click-ripple.md:99 rules/depth-of-field-blur.md:97 rules/depth-scatter-assemble.md:98 rules/discrete-text-sequence.md:84 rules/dynamic-content-sequencing.md:113 rules/gsap-effects.md:217 rules/gsap-effects.md:19 rules/gsap-effects.md:20 rules/hacker-flip-3d.md:86 rules/kinetic-beat-slam.md:88 rules/motion-blur-streak.md:130 rules/motion-blur-streak.md:159

📁 Filesystem access (50)

adapters/gsap-transforms-and-perf.md:120 adapters/gsap.md:65 adapters/gsap.md:83 examples/demo-page-scroll-spotlight.html:580 examples/demo-page-scroll-spotlight.html:582 examples/demo-page-scroll-spotlight.html:584 examples/hook-counter-burst.html:357 examples/hook-counter-burst.html:366 examples/problem-mockup-overwhelm.html:959 examples/problem-mockup-overwhelm.html:975 examples/proof-logo-chain.html:465 rules/avatar-cloud-network.md:259 rules/avatar-cloud-network.md:263 rules/avatar-cloud-network.md:266 rules/cursor-click-ripple.md:169 rules/cursor-click-ripple.md:176 rules/cursor-click-ripple.md:181 rules/cursor-click-ripple.md:187 rules/cursor-click-ripple.md:193 rules/cursor-click-ripple.md:198 rules/cursor-click-ripple.md:204 rules/cursor-click-ripple.md:210 rules/cursor-click-ripple.md:215 rules/cursor-click-ripple.md:222 rules/cursor-click-ripple.md:226 rules/cursor-click-ripple.md:231 rules/dynamic-content-sequencing.md:249 rules/dynamic-content-sequencing.md:255 rules/dynamic-content-sequencing.md:261 rules/dynamic-content-sequencing.md:267 rules/dynamic-content-sequencing.md:273 rules/dynamic-content-sequencing.md:279 rules/dynamic-content-sequencing.md:285 rules/gsap-effects.md:218 rules/hacker-flip-3d.md:167 rules/hacker-flip-3d.md:171 rules/hacker-flip-3d.md:175 rules/hacker-flip-3d.md:179 rules/hacker-flip-3d.md:183 rules/kinetic-beat-slam.md:155 rules/kinetic-beat-slam.md:169 rules/kinetic-beat-slam.md:181 rules/motion-blur-streak.md:300 rules/motion-blur-streak.md:325 rules/orbit-3d-entry.md:181 rules/orbit-3d-entry.md:187 rules/orbit-3d-entry.md:193 rules/orbit-3d-entry.md:199 rules/orbit-3d-entry.md:205 rules/orbit-3d-entry.md:211

⚡ Contains scripts (4)

rules/hacker-flip-3d.md:95 scripts/package-loader.mjs:54 scripts/package-loader.test.mjs:17 scripts/package-loader.test.mjs:30

🔑 Env variables (28)

Audited by: claude View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/heygen-com-hyperframes-animation/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/heygen-com-hyperframes-animation/security.svg)](https://skillstore.io/skills/heygen-com-hyperframes-animation?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/heygen-com-hyperframes-animation?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/heygen-com-hyperframes-animation/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/heygen-com-hyperframes-animation.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

heygen-com. (2026). hyperframes-animation security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/heygen-com-hyperframes-animation/audits/5

BibTeX citation

@techreport{heygen-com-heygen-com-hyperframes-animation-2026,
  author = {heygen-com},
  title = {hyperframes-animation security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/heygen-com-hyperframes-animation/audits/5},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "hyperframes-animation security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
  - name: "heygen-com"
date-released: "2026-07-19"
url: "https://skillstore.io/skills/heygen-com-hyperframes-animation/audits/5"
identifiers:
  - type: other
    value: "skillstore:heygen-com-hyperframes-animation:audit:5"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Build a product interface reveal

Combine cursor, card, counter, and press rules into a timed product demonstration.

Plan a branded motion sequence

Start from a multi-phase blueprint and tailor its timing, typography, and scene transitions.

Review animation choreography

Run the animation-map workflow to inspect tween coverage, stagger timing, and inactive periods.

Try These Prompts

Choose a motion rule

Suggest two HyperFrames animation rules for a headline that enters, settles, and remains readable. Explain the order and timing.

Create a UI scene

Create a seek-safe HyperFrames GSAP timeline for a dashboard card that reveals a metric, counts up, and highlights a final action.

Adapt a blueprint

Adapt the cursor UI demo blueprint for a 6-second product workflow. List phases, selected rules, timeline labels, and deterministic constraints.

Audit choreography

Explain how to run animation-map on my HyperFrames composition. Then help interpret dead zones, stagger notes, and lifecycle warnings from its report.

Best Practices

Use one paused timeline with explicit labels and a defined scene duration.
Select only the rules needed for the story, then test the composition at several seek positions.
Pin helper package versions when running the animation-map script outside a bundled installation.

Avoid

Do not create infinite or time-dependent animation loops in a deterministic composition.
Do not mix unrelated motion rules without a clear phase order or visual purpose.
Do not treat animation-map output as a substitute for visual and accessibility review.