Versioned security assessment

Report ID: SA-93A78AEB

7/6/2026, 2:28:41 PM

media-use security assessment v2

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
media-use
Version
v2
Maintainer
heygen-com
Source
github.com/heygen-com/hyperframes/tree/main/skills/media-use/
Coverage
18 Files scanned · 2,000 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Critical

4 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static matches are false positives from Markdown backticks, JavaScript template literals, tests, comments, and CSS. Confirmed risks include the curl-to-shell installer documentation, hidden home-directory cache usage, external HeyGen and ffprobe execution, and unvalidated provider downloads. No prompt injection text was found.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

18 Files scanned · 2,000 Lines analyzed

18 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 1 evidence location

Network access

May connect to external services.

Observed in 2 evidence locations

Filesystem access

May read or write local files.

Observed in 54 evidence locations

Env variables

May read values from the process environment.

Observed in 1 evidence location

External commands

May invoke commands or programs outside the Skill.

Observed in 109 evidence locations

Capability review items (14)
High
scripts/lib/freeze.mjs:9
Fetch API call
const res = await fetch(url);
freezeUrl fetches a provider-supplied URL and writes the response to disk without checking scheme or host. A compromised provider response could force downloads from unexpected locations.
High
scripts/lib/heygen-search.mjs:1
Node.js child_process module
import { execFileSync } from "node:child_process";
The runtime module imports child_process specifically to run the heygen CLI. Arguments are passed safely as argv, but the skill still depends on a trusted external binary and authenticated network service.
High
scripts/lib/heygen-search.mjs:23
Synchronous file execution
out = execFileSync("heygen", args, {
The skill executes heygen with user-provided search terms and receives asset URLs from that external command. No shell injection is evident, but the external command is a real trust boundary.
High
scripts/lib/probe.mjs:1
Node.js child_process module
import { execFileSync } from "node:child_process";
The module imports child_process to run ffprobe over media files. It uses argv arrays without a shell, but parsing untrusted media through an external binary remains a local execution dependency.
High
scripts/lib/probe.mjs:13
Synchronous file execution
const raw = execFileSync(
probe() invokes ffprobe on file paths from local assets. The argv array mitigates command injection, but the skill still runs an external parser on user-controlled media files.
High
SKILL.md:66
Hidden file in home directory
3. Check global cache `~/.media/` for reusable asset
The skill documents a global cache in ~/.media for cross-project asset reuse. This is intentional, but it persists data outside the project in a hidden home directory.
High
SKILL.md:101
Hidden file in home directory
Assets are cached automatically on resolve. Subsequent resolves for the same prompt hit the global c
The cross-project cache uses ~/.media and can persist resolved assets between projects. Hidden home-directory storage is a real capability even though it is documented.
High
SKILL.md:107
Hidden file in home directory
- `~/.media/` — global cross-project reuse cache (content-addressed, SHA-256)
The file list explicitly identifies ~/.media as the global reuse cache. This hidden home-directory storage should require user awareness and cleanup guidance.
High
SKILL.md:119
Hidden file in home directory
curl -fsSL https://static.heygen.ai/cli/install.sh | bash # installs latest to ~/.local/bin
The install example says the remote installer writes into ~/.local/bin. This hidden home-directory executable path is security relevant when combined with the curl-to-shell installer.
Medium
SKILL.md:66
Hidden file access
3. Check global cache `~/.media/` for reusable asset
The documented workflow reads from a hidden ~/.media cache. This is expected for the skill, but it is still hidden home-directory filesystem access.
Medium
SKILL.md:101
Hidden file access
Assets are cached automatically on resolve. Subsequent resolves for the same prompt hit the global c
The documentation says resolved assets are cached under ~/.media for reuse. That hidden path access is intentional but security relevant for marketplace users.
Medium
SKILL.md:107
Hidden file access
- `~/.media/` — global cross-project reuse cache (content-addressed, SHA-256)
The documented ~/.media cache is a hidden local store outside the active project. It should be treated as persistent state rather than a false scanner hit.
Medium
SKILL.md:119
Hidden file access
curl -fsSL https://static.heygen.ai/cli/install.sh | bash # installs latest to ~/.local/bin
The install instructions reference ~/.local/bin as a target for installed tooling. This is user-directed, but it still writes executable files under a hidden home path.
Low
SKILL.md:119
Hardcoded URL
curl -fsSL https://static.heygen.ai/cli/install.sh | bash # installs latest to ~/.local/bin
The hardcoded URL is the documented HeyGen installer endpoint. It is expected, but it is still a network dependency for installing executable tooling.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (4)

RISK-001 Critical
SKILL.md:119
Pipe to shell pattern
curl -fsSL https://static.heygen.ai/cli/install.sh | bash # installs latest to ~/.local/bin
The documentation instructs users to pipe a remote installer script directly into bash. This is a high-impact supply-chain pattern because fetched code executes immediately.
RISK-002 High
scripts/resolve.mjs:160-170scripts/lib/freeze.mjs:8-19scripts/lib/image-provider.mjs:8-31
Unvalidated Provider Download URLs
Provider results supply media URLs that freezeUrl fetches and writes to disk without scheme or host allowlisting. A compromised CLI or backend response could redirect downloads to unexpected hosts or local-network endpoints.
resolve.mjs passes provider searchResult.url directly to freezeUrl. freezeUrl downloads the URL without validating protocol, host, or content type before writing bytes.
RISK-003 Medium
scripts/lib/cache.mjs:76-87scripts/lib/cache.mjs:105-113
Manifest and Cache Paths Are Trusted
Cache import and promotion logic trust paths stored in local manifests and cache records. A malicious or corrupted manifest can point copy and hash operations outside the intended project or cache boundary.
importFromCache copies cacheRecord.cached_path and promote hashes join(projectDir, record.path) without rejecting absolute paths or normalized parent traversal. Exploitation requires a malicious local manifest or cache record.
RISK-004 Medium
scripts/eval.mjs:203-224scripts/eval.mjs:230-233
Evaluation Report HTML Injection
The evaluation report interpolates manifest descriptions, paths, and asset references into HTML without consistent escaping. A crafted filename or manifest value could execute markup when the report is opened.
The report generator escapes the full index block later, but table cells are built directly from manifest and asset reference strings. The issue is limited to generated eval-report.html.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Critical
    Network installer is piped directly to bash.
    Replace the curl-to-shell instruction with checksum-pinned download steps and a fixed CLI version.
  2. FIX-002
    High
    Provider download URLs are trusted without validation.
    Require https and an allowlist of expected HeyGen asset hosts before freezeUrl downloads or writes any bytes.
  3. FIX-003
    Medium
    Manifest and cache paths can escape intended directories.
    Reject absolute paths and normalized parent traversal before contentHash, importFromCache, and promote use stored paths.
  4. FIX-004
    Medium
    The evaluation report interpolates unescaped manifest data.
    Escape all manifest fields, asset references, filenames, and descriptions before writing eval-report.html.
  5. FIX-005
    Medium
    The global cache stores assets in a hidden home-directory path.
    Make global cache reuse opt-in or document clear inspection and cleanup steps for ~/.media.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (1)
Critical
scripts/lib/probe.mjs:11
Recursive delete on root/home
// execFileSync (no shell) so a hostile filename like `"; rm -rf ~; ".png`
Force-confirmed blocker/critical static finding; AI dismissal overridden.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable