技能 website-to-video
📦
website-to-video
内容修订 r2 高风险 📁 文件系统访问⚡ 包含脚本🔑 环境变量⚙️ 外部命令🌐 网络访问
从捕获的页面创建网站视频
当品牌素材、节奏、旁白和验证分散在各处时，将实时网站转化为清晰的视频会很困难。此技能会引导 Claude、Codex 或 Claude Code 完成 HyperFrames 视频的捕获、故事板、构建和审查步骤。
支持: Claude Codex Code(CC)
安装前请停下并请求确认。
请审查安装计划，并在更改文件前获得用户明确同意。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "website-to-video" from https://skillstore.io/skills/heygen-com-website-to-video.md and its manifest at https://skillstore.io/api/skills/heygen-com-website-to-video/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“website-to-video”。 作品集网站需要一个 15 秒的竖版预告片。
预期结果:
- 围绕受众、语气和信息的简洁网站总结。
- 包含简短脚本和时长计划的三段式故事板。
- 经过验证的 HyperFrames 预览 URL，并注明检查项和限制。
正在使用“website-to-video”。 公司主页需要一个 30 秒的旁白展示视频。
预期结果:
- 一个总结颜色、字体、组件和对比度决策的 DESIGN.md 文件。
- 包含已批准节拍、字幕和语音提供商选择的旁白故事板。
- 包含 lint、快照、素材和播放证据的最终交接总结。
安全审计
高风险v5 • 2026/7/23 打开版本化报告
Most static alerts are lexical false positives caused by Markdown links, code formatting, CSS terms, and JavaScript regular expressions. Confirmed concerns include unsafe chat-based credential handling, broad HOME searches, a predictable temporary file, and a remote script without integrity protection. The capture and Gemini workflows also need stronger URL boundaries and confidential-content safeguards.
13
已扫描文件
4,218
分析行数
8
复核项
0
已忽略误报
已确认安全问题 (4)
高
Environment file access
- **ElevenLabs:** "Add `ELEVENLABS_API_KEY=your-key` to a `.env` file in the project root, or just p
The line offers both a project .env file and chat as credential storage without requiring exclusion from logs or version control.
高
Environment file access
- **HeyGen:** "Add `HEYGEN_API_KEY=your-key` to a `.env` file, or paste it here."
The line directs handling a reusable HeyGen key through a project file or chat without protective storage requirements.
高
Unrestricted Website Capture Target
The workflow passes a user-supplied URL directly to the capture command without requiring protocol checks or blocking loopback, private, link-local, and metadata addresses.
The documented command accepts an arbitrary URL, and the surrounding capture instructions provide no destination validation or network boundary.
中
Incomplete Disclosure for External Image Analysis
Gemini analysis processes captured website images and video snapshots, but the guidance explains quality and cost without warning about confidential content leaving the local environment.
The text states that Gemini describes captured images and snapshot frames. It asks about a key but omits a confidentiality and third-party transfer warning.
能力复核项 (8)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
高
Generic API/secret keys
- **ElevenLabs:** "Add `ELEVENLABS_API_KEY=your-key` to a `.env` file in the project root, or just p
The guidance invites users to paste an ElevenLabs API key into chat. Chat history and agent logs are inappropriate credential channels.
高
Generic API/secret keys
- **HeyGen:** "Add `HEYGEN_API_KEY=your-key` to a `.env` file, or paste it here."
The guidance explicitly invites a HeyGen API key to be pasted into chat. This can expose a reusable account credential.
中
Standard device file access
find "$HOME" -path '*/website-to-video/assets/sfx/manifest.json' -maxdepth 10 2>/dev/null | head -1
The command recursively searches the entire HOME tree to locate a manifest. This exceeds the project scope and exposes unrelated directory names.
中
Standard device file access
Every text element in this beat must name a specific effect from the catalog. The reference page is
The fallback command recursively searches HOME for another skill reference. A configured skill root would avoid broad filesystem enumeration.
中
Temp directory access
npx hyperframes tts "First sentence. Second sentence." --voice af_nova --output /tmp/test-tts.wav
The command writes to a predictable shared /tmp filename. On multi-user systems, collisions or symlink substitution could overwrite another accessible file.
中
Hardcoded URL
<script src="https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js"></script>
Generated projects execute GSAP from a third-party CDN without an integrity hash. CDN compromise or replacement would execute remote code in the preview origin.
中
Standard device file access
find "$HOME" -path '*/website-to-video/references/beat-builder-guide.md' -maxdepth 10 2>/dev/null |
The sub-agent instruction searches the complete HOME tree for the guide. It grants broader filesystem visibility than the build requires.
中
Standard device file access
(Locate the repo root from a project subdirectory: `find "$HOME" -path '*/skills/website-to-video/sc
The repository lookup recursively scans HOME. Deterministic installation metadata should provide this path without enumerating unrelated directories.
风险因素
📁 文件系统访问 (40)
references/beat-builder-guide.md:17 references/beat-builder-guide.md:18 references/beat-builder-guide.md:19 references/beat-builder-guide.md:20 references/beat-builder-guide.md:21 references/beat-builder-guide.md:22 references/beat-builder-guide.md:23 references/beat-builder-guide.md:24 references/beat-builder-guide.md:25 references/beat-builder-guide.md:26 references/beat-builder-guide.md:27 references/beat-builder-guide.md:28 references/beat-builder-guide.md:165 references/beat-builder-guide.md:237 references/capabilities.md:277 references/step-3-storyboard.md:48 references/step-3-storyboard.md:65 references/step-3-storyboard.md:66 references/step-3-storyboard.md:111 references/step-3-storyboard.md:188 references/step-3-storyboard.md:352 references/step-3-storyboard.md:365 references/step-3-storyboard.md:129 references/step-3-storyboard.md:132 references/step-3-storyboard.md:135 references/step-3-storyboard.md:195 references/step-3-storyboard.md:365 references/step-4-vo.md:226 references/step-4-vo.md:31 references/step-4-vo.md:114 references/step-4-vo.md:173 references/step-5-build.md:282 references/step-5-build.md:284 references/step-5-build.md:304 references/step-6-validate.md:144 references/step-6-validate.md:45 scripts/w2h-verify.mjs:346 SKILL.md:39 SKILL.md:145 SKILL.md:146
⚡ 包含脚本 (6)
🔑 环境变量 (12)
references/step-0-capture.md:9 references/step-4-vo.md:63 references/step-4-vo.md:64 references/step-4-vo.md:80 references/step-4-vo.md:84 references/step-4-vo.md:95 references/step-4-vo.md:101 references/step-4-vo.md:106 references/step-6-validate.md:290 references/step-6-validate.md:132 references/step-6-validate.md:133 references/step-6-validate.md:144
⚙️ 外部命令 (50)
references/step-1-design.md:65-67 references/step-1-design.md:67-69 references/step-1-design.md:69-70 references/step-1-design.md:70-71 references/step-1-design.md:71-73 references/step-1-design.md:73-75 references/step-1-design.md:75-76 references/step-1-design.md:76-77 references/step-1-design.md:77-78 references/step-1-design.md:78-79 references/step-1-design.md:79-80 references/step-1-design.md:93-94 references/step-1-design.md:94-95 references/step-1-design.md:95-96 references/step-1-design.md:96-97 references/step-1-design.md:97-98 references/step-1-design.md:98-99 references/step-1-design.md:99-100 references/step-1-design.md:100-101 references/step-1-design.md:101-103 references/step-1-design.md:103-105 references/step-1-design.md:126-128 references/step-1-design.md:128-132 references/step-1-design.md:132-142 references/step-1-design.md:213-219 references/step-1-design.md:219 references/step-1-design.md:259-271 references/step-1-design.md:271 references/step-1-design.md:272 references/step-1-design.md:273 references/step-1-design.md:274 references/step-1-design.md:275 references/step-1-design.md:299-302 references/step-5-build.md:308-309 references/step-5-build.md:309-352 references/step-5-build.md:466-469 references/step-6-validate.md:20-21 references/step-6-validate.md:21-24 references/step-6-validate.md:133-140 references/step-6-validate.md:202-210 references/step-6-validate.md:227-231 scripts/w2h-verify.mjs:242 scripts/w2h-verify.mjs:410 scripts/w2h-verify.mjs:510 scripts/w2h-verify.mjs:634 scripts/w2h-verify.mjs:690 scripts/w2h-verify.mjs:54 scripts/w2h-verify.mjs:85 scripts/w2h-verify.mjs:117 scripts/w2h-verify.mjs:127
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/heygen-com-website-to-video/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/heygen-com-website-to-video?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/heygen-com-website-to-video?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/heygen-com-website-to-video/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/heygen-com-website-to-video.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
heygen-com. (2026). website-to-video security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/heygen-com-website-to-video/audits/5BibTeX 引用
@techreport{heygen-com-heygen-com-website-to-video-2026,
author = {heygen-com},
title = {website-to-video security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/heygen-com-website-to-video/audits/5},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "website-to-video security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
- name: "heygen-com"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/heygen-com-website-to-video/audits/5"
identifiers:
- type: other
value: "skillstore:heygen-com-website-to-video:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 中 82
架构
85
可维护性
87
内容
67
社区
83
规范符合性
你能构建什么
创建网站导览
将落地页转化为一个简短的旁白导览，用于解释信息、视觉识别和主要行动号召。
展示作品集
捕获作品集网站，并使用网站素材和语气制作竖版或方形社交短片。
准备客户视频草稿
构建故事板、脚本、配音计划和已验证的 HyperFrames 预览，用于客户审查。
试试这些提示
开始制作基础网站短片
Use website-to-video to make a 15-second vertical social clip from this URL: <url>. Keep the message simple and use the site assets.
先规划再构建
Use website-to-video for this site: <url>. First propose the video message, audience, format, duration, and narrative arc before building.
创建旁白导览
Use website-to-video to create a 30-second narrated site tour from <url>. Ask me to approve the storyboard and script before voiceover.
运行完整验证
Use website-to-video for <url>. Build the HyperFrames project, run lint, validate snapshots, check audio timing, and report every verification result.
最佳实践
- 在捕获前确认路线，以便产品发布和无关的视频任务使用正确的技能。
- 在选择视觉素材或生成配音之前，先锁定信息、受众、格式和叙事弧线。
- 保持捕获的素材可见，并在分享最终 Studio 预览前验证每个节拍。
避免
- 不要因为启用了自主模式就跳过验证节点。
- 当捕获到的品牌素材可用时，不要用通用 CSS 重建所有视觉效果。
- 除非所选提供商或快照工作流需要，否则不要索要 API keys。
常见问题
这个技能适用于哪类网站？
它适用于基于用户提供的 URL 制作的一般网站导览、作品集展示、主页短片和社交视频。
它会自动渲染最终 MP4 吗？
不会。默认交付物是 HyperFrames Studio 预览 URL。只有在被请求时才会渲染 MP4。
它可以在没有付费语音提供商的情况下工作吗？
可以。Kokoro 可以在本地运行，用于旁白草稿。HeyGen 和 ElevenLabs 需要用户提供凭据。
该技能会使用网站中的素材吗？
会。它会捕获截图、logo、插图、字体和可见文本，然后使用它们来指导视频。
用户一开始应该提供什么？
请提供 URL、期望时长、目标格式、受众，以及视频必须传达的主要信息。
哪些任务不在范围内？
产品发布视频、pull request 视频、没有网站的主题讲解，以及对现有视频的编辑应使用其他工作流。