Skills music-to-video

📦

music-to-video

Name: music-to-video
Author: heygen-com

Content revision r2 High Risk 📁 Filesystem access⚡ Contains scripts⚙️ External commands🌐 Network access

Create beat-synced music videos

Turning a track into a structured video requires timing, visual planning, and rendering steps. This skill guides Claude through a beat-aware HyperFrames workflow from audio analysis to a reviewed MP4.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "music-to-video" from https://skillstore.io/skills/heygen-com-music-to-video.md and its manifest at https://skillstore.io/api/skills/heygen-com-music-to-video/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/heygen-com-music-to-video.md Signed manifest GET /api/skills/heygen-com-music-to-video/manifest Signed lockfile GET /api/skills/heygen-com-music-to-video/lockfile

Test it

Using "music-to-video". A 30-second rhythmic track with no visual assets.

Expected outcome:

A timing map with beat and energy information.
A storyboard with frame durations and kinetic typography treatments.
A verified video project ready for rendering.

Using "music-to-video". A product track with six supplied images.

Expected outcome:

A frame plan that assigns images to beat-aligned groups.
A project index that mounts the frame compositions and background music.
Snapshots for review before MP4 rendering.

Security Audit

High Risk

v5 • 7/19/2026 Open versioned report

Most static findings are false positives caused by JavaScript template literals, fixed relative asset references, and a minified third-party GSAP bundle. The audit identified a silent remote update command and unsafe handling of storyboard-controlled paths and HTML attributes; these require remediation before publication.

Files scanned

11,677

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

High

SKILL.md:6

Silent remote skill update

The workflow instructs the agent to run a package-manager update command silently before use. This downloads and executes current remote package content without user approval or version pinning.

The instruction explicitly says to run npx hyperframes skills update silently and not ask. This is an externally sourced code-execution path before the requested workflow begins.

High

scripts/assemble-index.mjs:84-100

Unbounded storyboard source path

The assembler joins a storyboard-controlled frame source with the project directory and reads it without verifying that the resolved path remains inside the project. A crafted storyboard can reference readable files outside the project.

The source path comes from parsed storyboard metadata, is passed to join, and is read with readFileSync without a containment check. Relative traversal segments are not rejected.

Medium

scripts/assemble-index.mjs:133-149

Unescaped storyboard values in generated HTML

The assembler inserts storyboard-controlled frame paths directly into HTML attributes without escaping. A path containing quote characters can alter the generated document when a matching file exists.

The template interpolates m.frame.src into data-composition-src with no HTML escaping. Exploitation requires control of storyboard content and a corresponding local filename.

Risk Factors

📁 Filesystem access (50)

⚡ Contains scripts (10)

references/motion-primitives/assets/gsap.min.js:10 references/motion-primitives/assets/gsap.min.js:10 references/templates/held-message-living-field/index.html:204 scripts/lib/storyboard.mjs:107 scripts/lib/storyboard.mjs:115 scripts/lib/storyboard.mjs:146 scripts/lib/storyboard.mjs:165 scripts/lib/storyboard.mjs:208 scripts/lib/storyboard.mjs:214 scripts/validate-plan.mjs:111

⚙️ External commands (50)

🌐 Network access (6)

references/motion-primitives/assets/gsap.min.js:3 references/motion-primitives/assets/gsap.min.js:6 references/motion-primitives/assets/gsap.min.js:10 references/templates/held-message-living-field/index.html:21 references/templates/held-message-living-field/index.html:24 scripts/assemble-index.mjs:185

Audited by: claude View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/heygen-com-music-to-video/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/heygen-com-music-to-video/security.svg)](https://skillstore.io/skills/heygen-com-music-to-video?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/heygen-com-music-to-video?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/heygen-com-music-to-video/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/heygen-com-music-to-video.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

heygen-com. (2026). music-to-video security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/heygen-com-music-to-video/audits/5

BibTeX citation

@techreport{heygen-com-heygen-com-music-to-video-2026,
  author = {heygen-com},
  title = {music-to-video security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/heygen-com-music-to-video/audits/5},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "music-to-video security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
  - name: "heygen-com"
date-released: "2026-07-19"
url: "https://skillstore.io/skills/heygen-com-music-to-video/audits/5"
identifiers:
  - type: other
    value: "skillstore:heygen-com-music-to-video:audit:5"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Produce a lyric video

Turn a vocal track and timed lyrics into beat-aligned typography and frame treatments.

Build a product music promo

Combine a fast music track with supplied product images or clips for a short kinetic promo.

Create a social visualizer

Generate an asset-light visual video from a track and mood direction for social publishing.

Try These Prompts

Start a simple music video

Create a 30-second landscape music video from my track. Use kinetic typography and no external visual assets.

Plan a lyric video

Create a portrait lyric video from my song. Use these lyrics and align each line to the strongest musical phrases.

Use supplied media

Build a 20-second product music promo from my track and the images in this folder. Cut images on strong beats and keep text minimal.

Direct an advanced sequence

Create a 45-second square video from this electronic track. Use phrase-flow during calm sections, beat cuts during drops, and show me the storyboard before rendering.

Best Practices

Use music you have permission to analyze and publish.
Review the frame-by-frame storyboard before rendering.
Use phrase-based pacing when the track does not have a reliable beat.

Avoid

Do not use this workflow for narrated videos or website capture.
Do not force hard cuts on calm music with an unreliable beat grid.
Do not render before reviewing validation results and snapshots.

Frequently Asked Questions

What input does this skill need?

It needs a music track. You can also provide local images, video clips, lyrics, and a mood brief.

Can it work without visual assets?

Yes. The workflow can use typography, templates, and motion primitives without supplied media.

Does it support lyric videos?

Yes. Provide timed lyrics or use an available transcription workflow to obtain line timing.

When should I use phrase-flow pacing?

Use it for calm or weakly rhythmic music where the detected beat grid is not musically reliable.

What software is required?

You need Python with the listed audio libraries, ffmpeg, Node.js, and the HyperFrames CLI.

Does the skill publish the video?

No. It builds and renders a local MP4. You remain responsible for review and publishing.

Developer Details

Author

heygen-com

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/heygen-com/hyperframes/tree/main/skills/music-to-video/

Ref

77d0e66fbadeb1f5d1e6a5aada7861240b8ed2d7

Maintenance freshness

7/19/2026

Usage

2 downloads · 0 views

File structure

📁 references/

📄 frame-skeleton.md