Skills hyperframes-creative

📦

hyperframes-creative

Name: hyperframes-creative
Author: heygen-com

Content revision r2 Medium Risk 🌐 Network access📁 Filesystem access⚙️ External commands⚡ Contains scripts🔑 Env variables

Create a HyperFrames video design direction

Video teams need consistent visual decisions before they build scenes. This skill turns a brief into a practical direction for style, typography, pacing, composition, and narration.

Supports: Claude Codex Code(CC)

⚠️ 50 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "hyperframes-creative" from https://skillstore.io/skills/heygen-com-hyperframes-creative.md and its manifest at https://skillstore.io/api/skills/heygen-com-hyperframes-creative/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/heygen-com-hyperframes-creative.md Signed manifest GET /api/skills/heygen-com-hyperframes-creative/manifest Signed lockfile GET /api/skills/heygen-com-hyperframes-creative/lockfile

Test it

Using "hyperframes-creative". Create a direction for a 20-second climate data video.

Expected outcome:

Visual direction: editorial clarity with a deep navy background and coral data accents.
Typography: strong sans-serif headlines and compact labels.
Beat plan: hook, scale of change, key statistic, action, closing message.

Using "hyperframes-creative". Suggest a frame style for a premium product launch.

Expected outcome:

Style: quiet editorial layout with wide spacing and restrained motion.
Palette: warm off-white, charcoal text, and one muted accent.
Composition: centered product frame, short title card, and concise proof points.

Security Audit

Medium Risk

v6 • 7/19/2026 Open versioned report

Most static matches are false positives caused by JavaScript template literals, Markdown, local preview markup, and documented rendering utilities. The audit confirms optional npm bootstrap, dynamic package import, and unescaped innerHTML rendering as capabilities that require review; no credential exfiltration or prompt-injection attempt was found. Static review was capped at 400/847 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

Files scanned

28,811

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

scripts/package-loader.mjs:148-159

Unpinned dependency fallback during optional bootstrap

When no bundled version is found, the helper returns an @latest package specification. A confirmed bootstrap can therefore install a future, unreviewed release from npm.

The fallback and its @latest return value are explicit. Installation is user-confirmed and disables lifecycle scripts, which limits but does not remove supply-chain exposure.

Capability review items (17)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/package-loader.mjs:11

Node.js child_process module

import { spawnSync } from "node:child_process";

The module imports spawnSync to invoke npm and restart Node. Its documented argv-only invocation reduces injection risk, but the capability executes external programs.

High

scripts/package-loader.mjs:344

Synchronous spawn

const installResult = spawnSync(

The loader invokes npm and then restarts Node. Although arguments are passed as an argv array and installation requires confirmation, this is real external command execution and dependency installation.

High

scripts/package-loader.mjs:367

Synchronous spawn

const result = spawnSync(process.execPath, args, {

Medium

scripts/package-loader.mjs:54

Dynamic import() expression

modules[packageName] = await import(pathToFileURL(entry).href);

The loader dynamically imports a resolved package entry. Resolution is constrained to package lookup paths, but loading an attacker-controlled local package remains a meaningful execution boundary.

Medium

templates/design-picker.html:848