Skills hyperframes-cli

📦

hyperframes-cli

Name: hyperframes-cli
Author: heygen-com

Content revision r2 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables

Build and validate HyperFrames videos

Video composition workflows can require many CLI steps and validation checks. This skill guides HyperFrames setup, preview, render, comparison, and supported cloud workflows.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "hyperframes-cli" from https://skillstore.io/skills/heygen-com-hyperframes-cli.md and its manifest at https://skillstore.io/api/skills/heygen-com-hyperframes-cli/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/heygen-com-hyperframes-cli.md Signed manifest GET /api/skills/heygen-com-hyperframes-cli/manifest Signed lockfile GET /api/skills/heygen-com-hyperframes-cli/lockfile

Test it

Using "hyperframes-cli". Check my composition before the final render.

Expected outcome:

Recommended workflow: run lint, then run check.
Result: two layout warnings and one missing asset reference require attention.
Next step: fix the asset reference, rerun check, then create a final preview.

Using "hyperframes-cli". Prepare a cloud render without sending anything.

Expected outcome:

Preflight: review the project archive and exclude secrets or unrelated files.
Credentials: confirm the intended HeyGen account without displaying keys.
Action paused: explicit approval is required before upload or credit-consuming render.

Security Audit

High Risk

v6 • 7/19/2026 Open versioned report

Static matches are predominantly Markdown examples and documentation references, not executable behavior in this skill. The skill nevertheless guides users through real external operations, including project uploads, cloud deployment, publication, feedback submission, and URL-based capture; these require explicit user consent and credential review.

Files scanned

1,180

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (4)

High

references/cloud.md:39-49

Project upload can disclose local content

Hosted cloud rendering uploads a project archive. Users can unintentionally upload source assets or secrets if they do not review the project before rendering.

The documentation explicitly describes project upload and exclusions, which establishes an external data-transfer boundary.

High

references/cloudrun.md:3-9 references/cloudrun.md:62

Cloud deployment and destruction require consent

Cloud Run deployment provisions billable resources, and its destroy operation removes the scratch bucket. These side effects require explicit user approval.

The documented deploy and destroy operations have clear infrastructure, cost, and deletion effects.

High

SKILL.md:102-108 references/preview-render.md:178-188

Feedback and publishing can disclose project data

The skill instructs agents to capture feedback after a run, while publishing or filing an issue can send project material outside the local environment. Require confirmation before either action.

These sections describe external feedback and publication workflows, creating a clear consent and disclosure boundary.

Medium

references/init-and-scaffold.md:34-43 references/cloud.md:126-141

Unrestricted URL capture and callbacks are network trust boundaries

Capture accepts website URLs and cloud rendering accepts callback URLs. Do not use untrusted or internal addresses without validation and explicit approval.

The documented commands accept caller-supplied URLs and initiate network-facing workflows; address restrictions are not stated.

Risk Factors

⚙️ External commands (50)

🌐 Network access (8)

references/cloud.md:131 references/init-and-scaffold.md:35 references/init-and-scaffold.md:36 references/init-and-scaffold.md:37 references/init-and-scaffold.md:38 references/init-and-scaffold.md:39 references/init-and-scaffold.md:40 references/preview-render.md:19

📁 Filesystem access (21)

🔑 Env variables (2)

references/cloud.md:23 references/cloud.md:33

Audited by: claude View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/heygen-com-hyperframes-cli/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/heygen-com-hyperframes-cli/security.svg)](https://skillstore.io/skills/heygen-com-hyperframes-cli?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/heygen-com-hyperframes-cli?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/heygen-com-hyperframes-cli/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/heygen-com-hyperframes-cli.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

heygen-com. (2026). hyperframes-cli security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/heygen-com-hyperframes-cli/audits/6

BibTeX citation

@techreport{heygen-com-heygen-com-hyperframes-cli-2026,
  author = {heygen-com},
  title = {hyperframes-cli security audit report (audit version 6)},
  institution = {Skillstore},
  year = {2026},
  number = {6},
  url = {https://skillstore.io/skills/heygen-com-hyperframes-cli/audits/6},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "hyperframes-cli security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
  - name: "heygen-com"
date-released: "2026-07-19"
url: "https://skillstore.io/skills/heygen-com-hyperframes-cli/audits/6"
identifiers:
  - type: other
    value: "skillstore:heygen-com-hyperframes-cli:audit:6"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Create a first composition

Scaffold a project, add assets, and run an initial lint and preview loop.

Validate a release render

Run checks, snapshots, and comparisons before creating a final local render.

Plan a managed render

Review inputs, credentials, costs, and confirmation steps before using cloud rendering.

Try These Prompts

Start a local project

Create a new HyperFrames project for a 15-second product video. Use a non-interactive example and explain the next validation step.

Check a composition

Run the recommended HyperFrames lint and check workflow for this project. Summarize each issue and propose the smallest fix.

Compare revisions

Capture snapshots for the current composition and compare them with the approved baseline. Describe meaningful visual differences.

Prepare a cloud render

Prepare a HeyGen Cloud render, but do not upload, deploy, publish, or submit feedback. First list files that could be shared, credentials needed, expected cost factors, and confirmation points.

Best Practices

Run lint early and run check before final rendering.
Use snapshots and comparisons to review visual changes systematically.
Review files, account, cost, and destination before cloud, publish, or feedback actions.

Avoid

Do not run cloud deployment or destruction commands without explicit approval.
Do not upload project folders before checking for secrets and unrelated assets.
Do not treat a successful command exit code as proof that visual validation passed.