Versioned security assessment
Report ID: SA-3E4B6C31
7/9/2026, 7:53:37 AM
media-use security assessment v4
Skill Security Certification Report
Audit model: codex Historical report
- Skill name
- media-use
- Version
- v4
- Maintainer
- heygen-com
- Coverage
- 82 Files scanned · 9,330 Lines analyzed
- Policy version
- Unavailable
Highest confirmed finding severity
Critical
20 confirmed security findings require attention.
Installation context
Historical evidence
This report may not describe the currently installable artifact. Open the current Skill page for install guidance.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
The skill is a powerful media automation package with legitimate functionality, but it carries substantial security surface: subprocess execution, external provider calls, credential and home-directory access, global cross-project caching, and opt-out telemetry. I found many static false positives in tests, comments, Markdown backticks, ANSI escapes, and ML evaluation calls, but several runtime findings remain confirmed and require marketplace warnings or remediation before broad publication. Static review was capped at 400/1083 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
82 Files scanned · 9,330 Lines analyzed
155 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Binding unavailable
Artifact
Identity incomplete
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Observed in 17 evidence locations
Network access
May connect to external services.
Observed in 38 evidence locations
Filesystem access
May read or write local files.
Observed in 74 evidence locations
Env variables
May read values from the process environment.
Observed in 41 evidence locations
External commands
May invoke commands or programs outside the Skill.
Observed in 80 evidence locations
Capability review items (135)
High
Hidden file in home directory
| **HeyGen** (TTS + BGM/SFX retrieval) | `$HEYGEN_API_KEY` → `$HYPERFRAMES_API_KEY` → `~/.heygen/cre
The skill uses hidden home-directory state for caches, credentials, virtual environments, or tool outputs. This is documented, but it is real filesystem access outside the project.
High
Hidden file in home directory
Each command downloads its own model on first run and caches it under `~/.cache/hyperframes/`:
The skill uses hidden home-directory state for caches, credentials, virtual environments, or tool outputs. This is documented, but it is real filesystem access outside the project.
High
Hidden file in home directory
| 1 | HeyGen (Starfish) | `$HEYGEN_API_KEY` / `~/.heygen/credentials` | UUIDs from `GET /v3/voic
The skill uses hidden home-directory state for caches, credentials, virtual environments, or tool outputs. This is documented, but it is real filesystem access outside the project.
High
Hidden file in home directory
walks up ≤5 dirs) → `~/.heygen/credentials` (shared with heygen-cli;
The skill uses hidden home-directory state for caches, credentials, virtual environments, or tool outputs. This is documented, but it is real filesystem access outside the project.
High
Hidden file in home directory
// Requires: $HEYGEN_API_KEY (or ~/.heygen) and ffmpeg for .wav output.
The skill uses hidden home-directory state for caches, credentials, virtual environments, or tool outputs. This is documented, but it is real filesystem access outside the project.
High
Hidden file in home directory
// usable source wins — $HEYGEN_API_KEY / $HYPERFRAMES_API_KEY → a nearby .env → ~/.heygen/
The skill uses hidden home-directory state for caches, credentials, virtual environments, or tool outputs. This is documented, but it is real filesystem access outside the project.
High
Hidden file in home directory
"no HeyGen credentials — set $HEYGEN_API_KEY, or run `npx hyperframes auth login` (writes ~/.heygen/
The skill uses hidden home-directory state for caches, credentials, virtual environments, or tool outputs. This is documented, but it is real filesystem access outside the project.
High
Hidden file in home directory
// 1. HeyGen (Starfish) — $HEYGEN_API_KEY / $HYPERFRAMES_API_KEY / ~/.heygen.
The skill uses hidden home-directory state for caches, credentials, virtual environments, or tool outputs. This is documented, but it is real filesystem access outside the project.
High
Hidden file in home directory
# install once: uv venv ~/.venvs/parakeet && VIRTUAL_ENV=~/.venvs/parakeet uv pip install parakeet-m
The skill uses hidden home-directory state for caches, credentials, virtual environments, or tool outputs. This is documented, but it is real filesystem access outside the project.
High
Hidden file in home directory
// the latter nested it at ~/.media/.media/manifest.jsonl, invisible to the
The skill uses hidden home-directory state for caches, credentials, virtual environments, or tool outputs. This is documented, but it is real filesystem access outside the project.
High
Hidden file in home directory
// project (its own manifest) and across every project (the global ~/.media
The skill uses hidden home-directory state for caches, credentials, virtual environments, or tool outputs. This is documented, but it is real filesystem access outside the project.
High
Hidden file in home directory
"uv venv ~/.venvs/parakeet && VIRTUAL_ENV=~/.venvs/parakeet uv pip install parakeet-mlx",
The skill uses hidden home-directory state for caches, credentials, virtual environments, or tool outputs. This is documented, but it is real filesystem access outside the project.
High
Hidden file in home directory
install: "uv venv ~/.venvs/mflux && VIRTUAL_ENV=~/.venvs/mflux uv pip install mflux==0.9.6",
The skill uses hidden home-directory state for caches, credentials, virtual environments, or tool outputs. This is documented, but it is real filesystem access outside the project.
High
Hidden file in home directory
install: "uv venv ~/.venvs/mflux && VIRTUAL_ENV=~/.venvs/mflux uv pip install mflux",
The skill uses hidden home-directory state for caches, credentials, virtual environments, or tool outputs. This is documented, but it is real filesystem access outside the project.
High
Hidden file in home directory
install: "uv venv ~/.venvs/mflux && VIRTUAL_ENV=~/.venvs/mflux uv pip install mflux",
The skill uses hidden home-directory state for caches, credentials, virtual environments, or tool outputs. This is documented, but it is real filesystem access outside the project.
High
Hidden file in home directory
uv venv ~/.venvs/parakeet && VIRTUAL_ENV=~/.venvs/parakeet uv pip install parakeet-mlx`);
The skill uses hidden home-directory state for caches, credentials, virtual environments, or tool outputs. This is documented, but it is real filesystem access outside the project.
High
Hidden file in home directory
// the documented ~/.venvs/parakeet install, then PATH. Checking the venv (not
The skill uses hidden home-directory state for caches, credentials, virtual environments, or tool outputs. This is documented, but it is real filesystem access outside the project.
High
Hidden file in home directory
"parakeet-mlx not found (checked $HYPERFRAMES_PARAKEET, ~/.venvs/parakeet, and PATH). Install: uv ve
The skill uses hidden home-directory state for caches, credentials, virtual environments, or tool outputs. This is documented, but it is real filesystem access outside the project.
High
Hidden file in home directory
3. Check global cache `~/.media/` for a reusable asset matched on the same normalized prompt — auto-
The skill uses hidden home-directory state for caches, credentials, virtual environments, or tool outputs. This is documented, but it is real filesystem access outside the project.
High
Hidden file in home directory
5. Freeze file to `.media/<type>/`, register in manifest, regenerate `index.md`, auto-promote to `~/
The skill uses hidden home-directory state for caches, credentials, virtual environments, or tool outputs. This is documented, but it is real filesystem access outside the project.
High
Hidden file in home directory
- `~/.media/`: global cross-project reuse cache (content-addressed, SHA-256)
The skill uses hidden home-directory state for caches, credentials, virtual environments, or tool outputs. This is documented, but it is real filesystem access outside the project.
High
Linux /proc filesystem access
const out = String(exec("cat /proc/meminfo"));
The code reads /proc/meminfo to infer available RAM for local model selection. This is legitimate capability probing, but it is real system-information access.
High
Node.js child_process module
import { spawn, spawnSync } from "node:child_process";
The module imports Node child_process to run local tools such as ffmpeg, Codex, HeyGen, Python, or model utilities. That is real command-execution capability.
High
Node.js child_process module
import { spawnSync } from "node:child_process";
The module imports Node child_process to run local tools such as ffmpeg, Codex, HeyGen, Python, or model utilities. That is real command-execution capability.
High
Node.js child_process module
import { spawn, spawnSync } from "node:child_process";
The module imports Node child_process to run local tools such as ffmpeg, Codex, HeyGen, Python, or model utilities. That is real command-execution capability.
High
Node.js child_process module
import { execFileSync } from "node:child_process";
The module imports Node child_process to run local tools such as ffmpeg, Codex, HeyGen, Python, or model utilities. That is real command-execution capability.
High
Node.js child_process module
import { execFileSync } from "node:child_process";
The module imports Node child_process to run local tools such as ffmpeg, Codex, HeyGen, Python, or model utilities. That is real command-execution capability.
High
Node.js child_process module
import { execFileSync } from "node:child_process";
The module imports Node child_process to run local tools such as ffmpeg, Codex, HeyGen, Python, or model utilities. That is real command-execution capability.
High
Node.js child_process module
import { execFileSync } from "node:child_process";
The module imports Node child_process to run local tools such as ffmpeg, Codex, HeyGen, Python, or model utilities. That is real command-execution capability.
High
Node.js child_process module
import { execFileSync } from "node:child_process";
The module imports Node child_process to run local tools such as ffmpeg, Codex, HeyGen, Python, or model utilities. That is real command-execution capability.
High
Node.js child_process module
import { execFileSync } from "node:child_process";
The module imports Node child_process to run local tools such as ffmpeg, Codex, HeyGen, Python, or model utilities. That is real command-execution capability.
High
Node.js child_process module
import { execSync } from "node:child_process";
The module imports Node child_process to run local tools such as ffmpeg, Codex, HeyGen, Python, or model utilities. That is real command-execution capability.
High
Node.js child_process module
import { execFileSync } from "node:child_process";
The module imports Node child_process to run local tools such as ffmpeg, Codex, HeyGen, Python, or model utilities. That is real command-execution capability.
High
Node.js child_process module
import { execFileSync } from "node:child_process";
The module imports Node child_process to run local tools such as ffmpeg, Codex, HeyGen, Python, or model utilities. That is real command-execution capability.
High
Process exec
exec(fill(model.invoke, vars));
The code executes local system commands or command templates. Even when intended for local media tooling, this is a real command-execution risk.
High
Process exec
const out = String(exec("vm_stat"));
The code executes local system commands or command templates. Even when intended for local media tooling, this is a real command-execution risk.
High
Process exec
const out = String(exec("cat /proc/meminfo"));
The code executes local system commands or command templates. Even when intended for local media tooling, this is a real command-execution risk.
High
Process exec
const out = exec("nvidia-smi --query-gpu=memory.total --format=csv,noheader,nounits");
The code executes local system commands or command templates. Even when intended for local media tooling, this is a real command-execution risk.
High
Process spawn
const proc = spawn(cmd, args, { detached: true, stdio: ["ignore", fd, fd] });
The runtime code uses spawn or spawnSync to invoke Python, ffmpeg, npx, or model tooling. This is legitimate media automation, but it can execute local binaries.
High
Process spawn
const proc = spawn(cmd, args, { detached: true, stdio: ["ignore", fd, fd] });
The runtime code uses spawn or spawnSync to invoke Python, ffmpeg, npx, or model tooling. This is legitimate media automation, but it can execute local binaries.
High
Python exec() function
exec(fill(model.invoke, vars));
The code executes local system commands or command templates. Even when intended for local media tooling, this is a real command-execution risk.
High
Python exec() function
const out = String(exec("vm_stat"));
The code executes local system commands or command templates. Even when intended for local media tooling, this is a real command-execution risk.
High
Python exec() function
const out = String(exec("cat /proc/meminfo"));
The code executes local system commands or command templates. Even when intended for local media tooling, this is a real command-execution risk.
High
Python exec() function
const out = exec("nvidia-smi --query-gpu=memory.total --format=csv,noheader,nounits");
The code executes local system commands or command templates. Even when intended for local media tooling, this is a real command-execution risk.
High
Synchronous file execution
output: execFileSync(process.execPath, [RESOLVE_SCRIPT, ...args], {
The code uses synchronous process execution to run local CLIs or helper scripts. This can block and execute user-installed binaries, so it is a real operational security risk.
High
Synchronous file execution
return execFileSync("codex", args, {
The code uses synchronous process execution to run local CLIs or helper scripts. This can block and execute user-installed binaries, so it is a real operational security risk.
High
Synchronous file execution
execFileSync(which, ["codex"], { stdio: ["ignore", "ignore", "ignore"], timeout: 5000 });
The code uses synchronous process execution to run local CLIs or helper scripts. This can block and execute user-installed binaries, so it is a real operational security risk.
High
Synchronous file execution
execFileSync(
The code uses synchronous process execution to run local CLIs or helper scripts. This can block and execute user-installed binaries, so it is a real operational security risk.
High
Synchronous file execution
out = execFileSync("heygen", args, {
The code uses synchronous process execution to run local CLIs or helper scripts. This can block and execute user-installed binaries, so it is a real operational security risk.
High
Synchronous file execution
execFileSync("command", ["-v", bin], { stdio: "ignore", shell: true });
The code uses synchronous process execution to run local CLIs or helper scripts. This can block and execute user-installed binaries, so it is a real operational security risk.
High
Synchronous file execution
execFileSync(cmd, { stdio: ["ignore", "pipe", "pipe"], shell: true, timeout: 600000 });
The code uses synchronous process execution to run local CLIs or helper scripts. This can block and execute user-installed binaries, so it is a real operational security risk.
High
Synchronous file execution
const out = execFileSync("hf", ["download", repo], {
The code uses synchronous process execution to run local CLIs or helper scripts. This can block and execute user-installed binaries, so it is a real operational security risk.
High
Synchronous file execution
execFileSync("which", [bin], { stdio: ["ignore", "ignore", "ignore"] });
The code uses synchronous process execution to run local CLIs or helper scripts. This can block and execute user-installed binaries, so it is a real operational security risk.
High
Synchronous process execution
return execSync(cmd, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 4000 });
The code uses synchronous process execution to run local CLIs or helper scripts. This can block and execute user-installed binaries, so it is a real operational security risk.
High
Synchronous spawn
return spawnSync(cmd, args, { stdio: "ignore" }).status === 0;
The runtime code uses spawn or spawnSync to invoke Python, ffmpeg, npx, or model tooling. This is legitimate media automation, but it can execute local binaries.
High
Synchronous spawn
return spawnSync(cmd, args, { stdio: "ignore" }).status === 0;
The runtime code uses spawn or spawnSync to invoke Python, ffmpeg, npx, or model tooling. This is legitimate media automation, but it can execute local binaries.
High
Synchronous spawn
return spawnSync(cmd, args, { stdio: "ignore" }).status === 0;
The runtime code uses spawn or spawnSync to invoke Python, ffmpeg, npx, or model tooling. This is legitimate media automation, but it can execute local binaries.
High
Synchronous spawn
const r = spawnSync(cmd, args, {
The runtime code uses spawn or spawnSync to invoke Python, ffmpeg, npx, or model tooling. This is legitimate media automation, but it can execute local binaries.
High
Synchronous spawn
const r = spawnSync("ffmpeg", ["-i", absPath], { encoding: "utf8" });
The runtime code uses spawn or spawnSync to invoke Python, ffmpeg, npx, or model tooling. This is legitimate media automation, but it can execute local binaries.
High
Synchronous spawn
const r = spawnSync(
The runtime code uses spawn or spawnSync to invoke Python, ffmpeg, npx, or model tooling. This is legitimate media automation, but it can execute local binaries.
High
Synchronous spawn
const ff = spawnSync(
The runtime code uses spawn or spawnSync to invoke Python, ffmpeg, npx, or model tooling. This is legitimate media automation, but it can execute local binaries.
Medium
Hidden file access
| **HeyGen** (TTS + BGM/SFX retrieval) | `$HEYGEN_API_KEY` → `$HYPERFRAMES_API_KEY` → `~/.heygen/cre
The skill uses hidden home-directory state for caches, credentials, virtual environments, or tool outputs. This is documented, but it is real filesystem access outside the project.
Medium
Hidden file access
Each command downloads its own model on first run and caches it under `~/.cache/hyperframes/`:
The skill uses hidden home-directory state for caches, credentials, virtual environments, or tool outputs. This is documented, but it is real filesystem access outside the project.
Medium
Hidden file access
| 1 | HeyGen (Starfish) | `$HEYGEN_API_KEY` / `~/.heygen/credentials` | UUIDs from `GET /v3/voic
The skill uses hidden home-directory state for caches, credentials, virtual environments, or tool outputs. This is documented, but it is real filesystem access outside the project.
Medium
Hidden file access
walks up ≤5 dirs) → `~/.heygen/credentials` (shared with heygen-cli;
The skill uses hidden home-directory state for caches, credentials, virtual environments, or tool outputs. This is documented, but it is real filesystem access outside the project.
Medium
Hidden file access
// Requires: $HEYGEN_API_KEY (or ~/.heygen) and ffmpeg for .wav output.
The skill uses hidden home-directory state for caches, credentials, virtual environments, or tool outputs. This is documented, but it is real filesystem access outside the project.
Medium
Hidden file access
# install once: uv venv ~/.venvs/parakeet && VIRTUAL_ENV=~/.venvs/parakeet uv pip install parakeet-m
The skill uses hidden home-directory state for caches, credentials, virtual environments, or tool outputs. This is documented, but it is real filesystem access outside the project.
Medium
Hidden file access
// the latter nested it at ~/.media/.media/manifest.jsonl, invisible to the
The skill uses hidden home-directory state for caches, credentials, virtual environments, or tool outputs. This is documented, but it is real filesystem access outside the project.
Medium
Hidden file access
// project (its own manifest) and across every project (the global ~/.media
The skill uses hidden home-directory state for caches, credentials, virtual environments, or tool outputs. This is documented, but it is real filesystem access outside the project.
Medium
Hidden file access
"uv venv ~/.venvs/parakeet && VIRTUAL_ENV=~/.venvs/parakeet uv pip install parakeet-mlx",
The skill uses hidden home-directory state for caches, credentials, virtual environments, or tool outputs. This is documented, but it is real filesystem access outside the project.
Medium
Hidden file access
install: "uv venv ~/.venvs/mflux && VIRTUAL_ENV=~/.venvs/mflux uv pip install mflux==0.9.6",
The skill uses hidden home-directory state for caches, credentials, virtual environments, or tool outputs. This is documented, but it is real filesystem access outside the project.
Medium
Hidden file access
install: "uv venv ~/.venvs/mflux && VIRTUAL_ENV=~/.venvs/mflux uv pip install mflux",
The skill uses hidden home-directory state for caches, credentials, virtual environments, or tool outputs. This is documented, but it is real filesystem access outside the project.
Medium
Hidden file access
3. Check global cache `~/.media/` for a reusable asset matched on the same normalized prompt — auto-
The skill uses hidden home-directory state for caches, credentials, virtual environments, or tool outputs. This is documented, but it is real filesystem access outside the project.
Medium
Hidden file access
5. Freeze file to `.media/<type>/`, register in manifest, regenerate `index.md`, auto-promote to `~/
The skill uses hidden home-directory state for caches, credentials, virtual environments, or tool outputs. This is documented, but it is real filesystem access outside the project.
Medium
Hidden file access
- `~/.media/`: global cross-project reuse cache (content-addressed, SHA-256)
The skill uses hidden home-directory state for caches, credentials, virtual environments, or tool outputs. This is documented, but it is real filesystem access outside the project.
Medium
Synchronous file operations
import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
The runtime code performs synchronous filesystem reads or writes for manifests, media files, credentials, or generated output. This is expected but still a real local filesystem permission surface.
Medium
Synchronous file operations
request = JSON.parse(readFileSync(requestPath, "utf8"));
The runtime code performs synchronous filesystem reads or writes for manifests, media files, credentials, or generated output. This is expected but still a real local filesystem permission surface.
Medium
Synchronous file operations
const prev = existsSync(outPath) ? JSON.parse(readFileSync(outPath, "utf8")) : {};
The runtime code performs synchronous filesystem reads or writes for manifests, media files, credentials, or generated output. This is expected but still a real local filesystem permission surface.
Medium
Synchronous file operations
writeFileSync(outPath, JSON.stringify(meta, null, 2));
The runtime code performs synchronous filesystem reads or writes for manifests, media files, credentials, or generated output. This is expected but still a real local filesystem permission surface.
Medium
Synchronous file operations
import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
The runtime code performs synchronous filesystem reads or writes for manifests, media files, credentials, or generated output. This is expected but still a real local filesystem permission surface.
Medium
Synchronous file operations
? readFileSync(resolve(positional), "utf8").trim()
The runtime code performs synchronous filesystem reads or writes for manifests, media files, credentials, or generated output. This is expected but still a real local filesystem permission surface.
Medium
Synchronous file operations
writeFileSync(wordsPath, JSON.stringify(withWordIds(words), null, 2));
The runtime code performs synchronous filesystem reads or writes for manifests, media files, credentials, or generated output. This is expected but still a real local filesystem permission surface.
Medium
Synchronous file operations
import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
The runtime code performs synchronous filesystem reads or writes for manifests, media files, credentials, or generated output. This is expected but still a real local filesystem permission surface.
Medium
Synchronous file operations
for (const raw of readFileSync(envPath, "utf8").split("\n")) {
The runtime code performs synchronous filesystem reads or writes for manifests, media files, credentials, or generated output. This is expected but still a real local filesystem permission surface.
Medium
Synchronous file operations
const raw = readFileSync(file, "utf8").trim();
The runtime code performs synchronous filesystem reads or writes for manifests, media files, credentials, or generated output. This is expected but still a real local filesystem permission surface.
Medium
Synchronous file operations
writeFileSync(destPath, bytes);
The runtime code performs synchronous filesystem reads or writes for manifests, media files, credentials, or generated output. This is expected but still a real local filesystem permission surface.
Medium
Synchronous file operations
import { readFileSync } from "node:fs";
The runtime code performs synchronous filesystem reads or writes for manifests, media files, credentials, or generated output. This is expected but still a real local filesystem permission surface.
Medium
Synchronous file operations
const meta = JSON.parse(readFileSync(resolve(args.meta), "utf8"));
The runtime code performs synchronous filesystem reads or writes for manifests, media files, credentials, or generated output. This is expected but still a real local filesystem permission surface.
Medium
Synchronous file operations
const html = readFileSync(resolve(composition), "utf8");
The runtime code performs synchronous filesystem reads or writes for manifests, media files, credentials, or generated output. This is expected but still a real local filesystem permission surface.
Medium
Synchronous file operations
readFileSync,
The runtime code performs synchronous filesystem reads or writes for manifests, media files, credentials, or generated output. This is expected but still a real local filesystem permission surface.
Medium
Synchronous file operations
writeFileSync,
The runtime code performs synchronous filesystem reads or writes for manifests, media files, credentials, or generated output. This is expected but still a real local filesystem permission surface.
Medium
Synchronous file operations
const html = readFileSync(join(tmp, hf), "utf8");
The runtime code performs synchronous filesystem reads or writes for manifests, media files, credentials, or generated output. This is expected but still a real local filesystem permission surface.
Medium
Synchronous file operations
? readFileSync(indexPath, "utf8")
The runtime code performs synchronous filesystem reads or writes for manifests, media files, credentials, or generated output. This is expected but still a real local filesystem permission surface.
Medium
Synchronous file operations
? readFileSync(manifestPath, "utf8")
The runtime code performs synchronous filesystem reads or writes for manifests, media files, credentials, or generated output. This is expected but still a real local filesystem permission surface.
Medium
Synchronous file operations
writeFileSync(outPath, report);
The runtime code performs synchronous filesystem reads or writes for manifests, media files, credentials, or generated output. This is expected but still a real local filesystem permission surface.
Medium
Fetch API call
const res = await fetch(url);
The fetch downloads user-provided direct media URLs. The code applies checks and size limits, but it still performs outbound network retrieval.
Medium
Fetch API call
await fetch(`${POSTHOG_HOST}/batch/`, {
The fetch sends usage telemetry to PostHog unless the user opts out. The event claims to omit paths and intent, but it is still outbound network traffic.
Low
dotenv library
const LYRIA_PY_DEPS = ["google-genai", "python-dotenv"];
The package depends on dotenv-style environment loading for provider configuration. That is expected, but it expands access to local credential configuration.
Low
dotenv library
pip install google-genai python-dotenv. audio.mjs Step 4b installs these on
The package depends on dotenv-style environment loading for provider configuration. That is expected, but it expands access to local credential configuration.
Low
Environment variable access (bracket notation)
if (!(key in process.env)) process.env[key] = val;
The snippet reads the environment object. I did not find direct exfiltration here, but environment access is still part of the skill permission surface.
Low
Environment variable access (dot notation)
const lyriaKey = () => process.env.GEMINI_API_KEY || process.env.GOOGLE_API_KEY || "";
The code reads provider credentials or execution-related environment variables. This is real environment access and should be disclosed and scoped.
Low
Environment variable access (dot notation)
const envKey = process.env.HEYGEN_API_KEY || process.env.HYPERFRAMES_API_KEY;
The code reads provider credentials or execution-related environment variables. This is real environment access and should be disclosed and scoped.
Low
Environment variable access (dot notation)
const file = join(process.env.HEYGEN_CONFIG_DIR || join(homedir(), ".heygen"), "credentials");
The code reads provider credentials or execution-related environment variables. This is real environment access and should be disclosed and scoped.
Low
Environment variable access (dot notation)
if (!process.env.ELEVENLABS_API_KEY) return false;
The code reads provider credentials or execution-related environment variables. This is real environment access and should be disclosed and scoped.
Low
Environment variable access (dot notation)
if (userProvider === "elevenlabs" && !process.env.ELEVENLABS_API_KEY)
The code reads provider credentials or execution-related environment variables. This is real environment access and should be disclosed and scoped.
Low
Environment variable access (dot notation)
npmExecPath = process.env.npm_execpath,
The code reads provider credentials or execution-related environment variables. This is real environment access and should be disclosed and scoped.
Low
Environment variable access (dot notation)
return join(process.env.CODEX_HOME || join(homedir(), ".codex"), "generated_images");
The code reads provider credentials or execution-related environment variables. This is real environment access and should be disclosed and scoped.
Low
Environment variable access (dot notation)
const authPath = join(process.env.CODEX_HOME || join(homedir(), ".codex"), "auth.json");
The code reads provider credentials or execution-related environment variables. This is real environment access and should be disclosed and scoped.
Low
Environment variable object
const lyriaKey = () => process.env.GEMINI_API_KEY || process.env.GOOGLE_API_KEY || "";
The code reads provider credentials or execution-related environment variables. This is real environment access and should be disclosed and scoped.
Low
Environment variable object
if (!(key in process.env)) process.env[key] = val;
The snippet reads the environment object. I did not find direct exfiltration here, but environment access is still part of the skill permission surface.
Low
Environment variable object
const envKey = process.env.HEYGEN_API_KEY || process.env.HYPERFRAMES_API_KEY;
The code reads provider credentials or execution-related environment variables. This is real environment access and should be disclosed and scoped.
Low
Environment variable object
const file = join(process.env.HEYGEN_CONFIG_DIR || join(homedir(), ".heygen"), "credentials");
The code reads provider credentials or execution-related environment variables. This is real environment access and should be disclosed and scoped.
Low
Environment variable object
if (!process.env.ELEVENLABS_API_KEY) return false;
The code reads provider credentials or execution-related environment variables. This is real environment access and should be disclosed and scoped.
Low
Environment variable object
if (userProvider === "elevenlabs" && !process.env.ELEVENLABS_API_KEY)
The code reads provider credentials or execution-related environment variables. This is real environment access and should be disclosed and scoped.
Low
Environment variable object
npmExecPath = process.env.npm_execpath,
The code reads provider credentials or execution-related environment variables. This is real environment access and should be disclosed and scoped.
Low
Environment variable object
env = process.env,
The snippet reads the environment object. I did not find direct exfiltration here, but environment access is still part of the skill permission surface.
Low
Environment variable object
env = process.env,
The snippet reads the environment object. I did not find direct exfiltration here, but environment access is still part of the skill permission surface.
Low
Environment variable object
return join(process.env.CODEX_HOME || join(homedir(), ".codex"), "generated_images");
The code reads provider credentials or execution-related environment variables. This is real environment access and should be disclosed and scoped.
Low
Environment variable object
const authPath = join(process.env.CODEX_HOME || join(homedir(), ".codex"), "auth.json");
The code reads provider credentials or execution-related environment variables. This is real environment access and should be disclosed and scoped.
Low
Fetch API call
const res = await fetch(`${HEYGEN_BASE}${path}`, opts);
The code uses fetch for provider API calls or media downloads. This is expected for media resolution, but it is real external network access.
Low
Fetch API call
const res = await fetch(url);
The code uses fetch for provider API calls or media downloads. This is expected for media resolution, but it is real external network access.
Low
Fetch API call
const res = await fetch(inner.audio_url);
The code uses fetch for provider API calls or media downloads. This is expected for media resolution, but it is real external network access.
Low
Hardcoded URL
curl https://api.openai.com/v1/audio/transcriptions \
The documentation directs users to external service or install URLs. This is not hidden behavior, but it is a real network dependency for users who follow the guide.
Low
Hardcoded URL
curl https://api.groq.com/openai/v1/audio/transcriptions \
The documentation directs users to external service or install URLs. This is not hidden behavior, but it is a real network dependency for users who follow the guide.
Low
Hardcoded URL
export const HEYGEN_BASE = "https://api.heygen.com/v3";
The code hardcodes the HeyGen API base URL and sends provider requests to that external service. This is legitimate functionality but must be disclosed as network access.
Low
Hardcoded URL
| `heygen` | catalog (bgm/sfx/image/icon), TTS + avatar upsell | `c
The documentation directs users to external service or install URLs. This is not hidden behavior, but it is a real network dependency for users who follow the guide.
Low
Hardcoded URL
| `ltx-2-mlx` | local video gen | `g
The documentation directs users to external service or install URLs. This is not hidden behavior, but it is a real network dependency for users who follow the guide.
Low
Python environment access
client = ElevenLabs(api_key=os.environ["ELEVENLABS_API_KEY"])
The code reads provider credentials or execution-related environment variables. This is real environment access and should be disclosed and scoped.
Low
Python environment access
api_key = os.environ.get("GOOGLE_API_KEY") or os.environ.get("GEMINI_API_KEY") or ""
The code reads provider credentials or execution-related environment variables. This is real environment access and should be disclosed and scoped.
Low
Temp file creation
import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
The runtime code creates temporary files or directories for text, audio, transcription, or evaluation work. This is legitimate but should be bounded and cleaned up.
Low
Temp file creation
const td = mkdtempSync(join(tmpdir(), "hf-tts-"));
The runtime code creates temporary files or directories for text, audio, transcription, or evaluation work. This is legitimate but should be bounded and cleaned up.
Low
Temp file creation
const td = mkdtempSync(join(tmpdir(), "hf-trans-"));
The runtime code creates temporary files or directories for text, audio, transcription, or evaluation work. This is legitimate but should be bounded and cleaned up.
Low
Temp file creation
const td = mkdtempSync(join(tmpdir(), "hf-txt-"));
The runtime code creates temporary files or directories for text, audio, transcription, or evaluation work. This is legitimate but should be bounded and cleaned up.
Low
Temp file creation
mkdtempSync,
The runtime code creates temporary files or directories for text, audio, transcription, or evaluation work. This is legitimate but should be bounded and cleaned up.
Low
Temp file creation
const tmp = mkdtempSync(join(tmpdir(), `mu-eval-${name}-`));
The runtime code creates temporary files or directories for text, audio, transcription, or evaluation work. This is legitimate but should be bounded and cleaned up.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (20)
RISK-001 Critical
Pipe to shell pattern
| `heygen` | catalog (bgm/sfx/image/icon), TTS + avatar upsell | `c
The skill documentation tells users to run a remote install script through a shell pipeline. It is not executed automatically, but it creates a real supply-chain risk for users who follow the install instructions.
RISK-002 Critical
[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access
This combination is common in credential stealers and RATs
The skill contains real subprocess execution, external network calls, and credential lookups in the same package. I did not find exfiltration intent, but this combination is high-impact for a community skill.
RISK-003 Critical
[HEURISTIC] DANGEROUS COMBINATION: Network + Credentials + Evasion techniques
This combination suggests data exfiltration with anti-detection
The package combines network requests, credential access, and best-effort failure swallowing around telemetry and providers. No malicious intent was found, but the combination should fail closed for marketplace review.
RISK-004 High
Environment file access
`hyperframes auth login` (browser OAuth) is the recommended setup: one sign-in, every project, no pe
The code reads environment-derived state. The snippet is not clearly a secret, so this is kept at low confidence rather than dismissed.
RISK-005 High
Environment file access
wins: `$HEYGEN_API_KEY` → `$HYPERFRAMES_API_KEY` → a project `.env` (auto-loaded,
The skill reads credentials or tool state from environment variables, .env files, or home-directory auth files. That is legitimate provider integration, but it is sensitive access.
RISK-006 High
Environment file access
export HEYGEN_API_KEY=... # or put it in a project .env
The skill reads credentials or tool state from environment variables, .env files, or home-directory auth files. That is legitimate provider integration, but it is sensitive access.
RISK-007 High
Environment file access
const lyriaKey = () => process.env.GEMINI_API_KEY || process.env.GOOGLE_API_KEY || "";
The skill reads credentials or tool state from environment variables, .env files, or home-directory auth files. That is legitimate provider integration, but it is sensitive access.
RISK-008 High
Environment file access
// usable source wins — $HEYGEN_API_KEY / $HYPERFRAMES_API_KEY → a nearby .env → ~/.heygen/
The skill reads credentials or tool state from environment variables, .env files, or home-directory auth files. That is legitimate provider integration, but it is sensitive access.
RISK-009 High
Environment file access
// Walk up ≤5 dirs from startDir; load the first .env (shell env always wins).
The skill reads credentials or tool state from environment variables, .env files, or home-directory auth files. That is legitimate provider integration, but it is sensitive access.
RISK-010 High
Environment file access
const envPath = join(dir, ".env");
The skill reads credentials or tool state from environment variables, .env files, or home-directory auth files. That is legitimate provider integration, but it is sensitive access.
RISK-011 High
Environment file access
if (!(key in process.env)) process.env[key] = val;
The skill reads credentials or tool state from environment variables, .env files, or home-directory auth files. That is legitimate provider integration, but it is sensitive access.
RISK-012 High
Environment file access
const envKey = process.env.HEYGEN_API_KEY || process.env.HYPERFRAMES_API_KEY;
The skill reads credentials or tool state from environment variables, .env files, or home-directory auth files. That is legitimate provider integration, but it is sensitive access.
RISK-013 High
Environment file access
const file = join(process.env.HEYGEN_CONFIG_DIR || join(homedir(), ".heygen"), "credentials");
The skill reads credentials or tool state from environment variables, .env files, or home-directory auth files. That is legitimate provider integration, but it is sensitive access.
RISK-014 High
Environment file access
if (!process.env.ELEVENLABS_API_KEY) return false;
The skill reads credentials or tool state from environment variables, .env files, or home-directory auth files. That is legitimate provider integration, but it is sensitive access.
RISK-015 High
Environment file access
return join(process.env.CODEX_HOME || join(homedir(), ".codex"), "generated_images");
The skill reads credentials or tool state from environment variables, .env files, or home-directory auth files. That is legitimate provider integration, but it is sensitive access.
RISK-016 High
Environment file access
const authPath = join(process.env.CODEX_HOME || join(homedir(), ".codex"), "auth.json");
The skill reads credentials or tool state from environment variables, .env files, or home-directory auth files. That is legitimate provider integration, but it is sensitive access.
RISK-017 High
[HEURISTIC] SUSPICIOUS COMBINATION: Filesystem + Credentials + Network
This combination could indicate credential harvesting and exfiltration
The skill intentionally reads credentials, writes project and home-directory media state, and calls external services. This is expected media-provider behavior, but it is a real permission and privacy surface.
RISK-018 High
Cross-Project Global Cache Can Surface Prior Project Assets
The skill automatically promotes resolved or ingested assets to a global cache and lists global candidates for reuse. The documentation itself warns that another client brand mark and prompt text can appear in candidates, which is a privacy and business-context leakage risk.
The documentation and code both show automatic global promotion and candidate listing from the global manifest, including prompt and description fields.
RISK-019 High
URL Ingest SSRF Guard Does Not Resolve DNS
The direct URL ingest guard blocks literal private hosts, but the code comments state that DNS names resolving to private IPs still pass. A public-looking hostname could therefore route a fetch to internal network resources.
The code explicitly documents the DNS rebinding gap and fetches the URL after hostname pattern checks, so the SSRF limitation is real.
RISK-020 Medium
scripts/lib/telemetry.mjs:16-17scripts/lib/telemetry.mjs:31-40scripts/lib/telemetry.mjs:51-69SKILL.md:243-251
Telemetry Enabled By Default With Persistent Identifier
The skill sends usage events to PostHog unless opt-out variables are set, and it persists an anonymous identifier under the user home media directory. The implementation says it omits intent text, paths, and IP storage, but marketplace users still need clear consent and disclosure.
The code clearly defines a PostHog host and API key, creates or reads a persistent anonymous ID, and posts events unless opt-out flags are present.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001CriticalRemote shell installer in documentationReplace the curl-to-shell command with signed package installation steps, checksum verification, or a vendor-managed installer that users can inspect before execution.
- FIX-002HighCommand execution through local CLIs and shell templatesPrefer execFile or spawn with fixed argv arrays, remove shell:true where possible, and validate all provider command templates before use.
- FIX-003HighCredentials and home-directory files are read by provider helpersDocument every credential source, require explicit user consent before reading .env or home auth files, and avoid copying credential-derived data into manifests or logs.
- FIX-004HighGlobal media cache can expose cross-project assets and prompt textMake global cache promotion opt-in per project, add project or tenant isolation, and hide global brand candidates unless the entity matches exactly.
- FIX-005HighDirect URL ingest has a DNS rebinding SSRF gapResolve hostnames before fetch, block private resolved addresses, repeat checks after redirects, and enforce an allowlist for untrusted URL ingestion.
- FIX-006MediumStatic review cappedManually review the omitted 683 static analyzer matches or reduce bundled generated/vendor/reference content before enabling automatic publication.
- FIX-007MediumTelemetry sends events by defaultMake telemetry opt-in for marketplace installs or show a clear first-run disclosure with the exact fields sent and opt-out instructions.
- FIX-008LowBundled binary audio assets were not statically scannedPublish hashes and provenance for bundled MP3 files, review them manually, and keep only assets with verified licensing.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- Unavailable
- Content hash
- Unavailable
- Tree hash
- Unavailable
- Skill path
- Unavailable
- Audit payload hash
- Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable