スキル website-to-video
📦
website-to-video
コンテンツリビジョン r2 高リスク 📁 ファイルシステムへのアクセス⚡ スクリプトを含む🔑 環境変数⚙️ 外部コマンド🌐 ネットワークアクセス
從擷取的頁面建立網站影片
當品牌素材、節奏、旁白和驗證分散各處時，要將即時網站轉成清晰影片並不容易。此技能會引導 Claude、Codex 或 Claude Code 完成 HyperFrames 影片的擷取、分鏡、建置與審查步驟。
対応: Claude Codex Code(CC)
インストール前に停止して確認を求めてください。
計画を確認し、ファイルを変更する前にユーザーの明示的な同意を得てください。
自分のエージェントでインストール
このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。
エージェントリクエスト
Review the Skillstore skill "website-to-video" from https://skillstore.io/skills/heygen-com-website-to-video.md and its manifest at https://skillstore.io/api/skills/heygen-com-website-to-video/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。
エージェントが読めるリソース
AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。
テストする
「website-to-video」を使用しています。 作品集網站需要一支 15 秒直式 teaser。
期待される結果:
- 一份聚焦於受眾、語氣和訊息的精簡網站摘要。
- 一份三段式分鏡，包含短腳本和時間安排計畫。
- 一個經驗證的 HyperFrames 預覽 URL，並註明檢查項目和限制。
「website-to-video」を使用しています。 公司首頁需要一支 30 秒旁白展示影片。
期待される結果:
- 一個 DESIGN.md 檔案，摘要說明色彩、字型、元件和對比決策。
- 一份旁白分鏡，包含已核准的節拍、字幕和語音提供者選擇。
- 一份最終交接摘要，包含 lint、快照、素材和播放證據。
セキュリティ監査
高リスクv5 • 2026/7/23 バージョン別レポートを開く
Most static alerts are lexical false positives caused by Markdown links, code formatting, CSS terms, and JavaScript regular expressions. Confirmed concerns include unsafe chat-based credential handling, broad HOME searches, a predictable temporary file, and a remote script without integrity protection. The capture and Gemini workflows also need stronger URL boundaries and confidential-content safeguards.
13
スキャンされたファイル
4,218
解析済み行数
8
レビュー項目
0
誤検知を無視
確認済みのセキュリティ上の懸念 (4)
高
Environment file access
- **ElevenLabs:** "Add `ELEVENLABS_API_KEY=your-key` to a `.env` file in the project root, or just p
The line offers both a project .env file and chat as credential storage without requiring exclusion from logs or version control.
高
Environment file access
- **HeyGen:** "Add `HEYGEN_API_KEY=your-key` to a `.env` file, or paste it here."
The line directs handling a reusable HeyGen key through a project file or chat without protective storage requirements.
高
Unrestricted Website Capture Target
The workflow passes a user-supplied URL directly to the capture command without requiring protocol checks or blocking loopback, private, link-local, and metadata addresses.
The documented command accepts an arbitrary URL, and the surrounding capture instructions provide no destination validation or network boundary.
中
Incomplete Disclosure for External Image Analysis
Gemini analysis processes captured website images and video snapshots, but the guidance explains quality and cost without warning about confidential content leaving the local environment.
The text states that Gemini describes captured images and snapshot frames. It asks about a key but omits a confidentiality and third-party transfer warning.
機能レビュー項目 (8)
これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。
高
Generic API/secret keys
- **ElevenLabs:** "Add `ELEVENLABS_API_KEY=your-key` to a `.env` file in the project root, or just p
The guidance invites users to paste an ElevenLabs API key into chat. Chat history and agent logs are inappropriate credential channels.
高
Generic API/secret keys
- **HeyGen:** "Add `HEYGEN_API_KEY=your-key` to a `.env` file, or paste it here."
The guidance explicitly invites a HeyGen API key to be pasted into chat. This can expose a reusable account credential.
中
Standard device file access
find "$HOME" -path '*/website-to-video/assets/sfx/manifest.json' -maxdepth 10 2>/dev/null | head -1
The command recursively searches the entire HOME tree to locate a manifest. This exceeds the project scope and exposes unrelated directory names.
中
Standard device file access
Every text element in this beat must name a specific effect from the catalog. The reference page is
The fallback command recursively searches HOME for another skill reference. A configured skill root would avoid broad filesystem enumeration.
中
Temp directory access
npx hyperframes tts "First sentence. Second sentence." --voice af_nova --output /tmp/test-tts.wav
The command writes to a predictable shared /tmp filename. On multi-user systems, collisions or symlink substitution could overwrite another accessible file.
中
Hardcoded URL
<script src="https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js"></script>
Generated projects execute GSAP from a third-party CDN without an integrity hash. CDN compromise or replacement would execute remote code in the preview origin.
中
Standard device file access
find "$HOME" -path '*/website-to-video/references/beat-builder-guide.md' -maxdepth 10 2>/dev/null |
The sub-agent instruction searches the complete HOME tree for the guide. It grants broader filesystem visibility than the build requires.
中
Standard device file access
(Locate the repo root from a project subdirectory: `find "$HOME" -path '*/skills/website-to-video/sc
The repository lookup recursively scans HOME. Deterministic installation metadata should provide this path without enumerating unrelated directories.
リスク要因
📁 ファイルシステムへのアクセス (40)
references/beat-builder-guide.md:17 references/beat-builder-guide.md:18 references/beat-builder-guide.md:19 references/beat-builder-guide.md:20 references/beat-builder-guide.md:21 references/beat-builder-guide.md:22 references/beat-builder-guide.md:23 references/beat-builder-guide.md:24 references/beat-builder-guide.md:25 references/beat-builder-guide.md:26 references/beat-builder-guide.md:27 references/beat-builder-guide.md:28 references/beat-builder-guide.md:165 references/beat-builder-guide.md:237 references/capabilities.md:277 references/step-3-storyboard.md:48 references/step-3-storyboard.md:65 references/step-3-storyboard.md:66 references/step-3-storyboard.md:111 references/step-3-storyboard.md:188 references/step-3-storyboard.md:352 references/step-3-storyboard.md:365 references/step-3-storyboard.md:129 references/step-3-storyboard.md:132 references/step-3-storyboard.md:135 references/step-3-storyboard.md:195 references/step-3-storyboard.md:365 references/step-4-vo.md:226 references/step-4-vo.md:31 references/step-4-vo.md:114 references/step-4-vo.md:173 references/step-5-build.md:282 references/step-5-build.md:284 references/step-5-build.md:304 references/step-6-validate.md:144 references/step-6-validate.md:45 scripts/w2h-verify.mjs:346 SKILL.md:39 SKILL.md:145 SKILL.md:146
⚡ スクリプトを含む (6)
🔑 環境変数 (12)
references/step-0-capture.md:9 references/step-4-vo.md:63 references/step-4-vo.md:64 references/step-4-vo.md:80 references/step-4-vo.md:84 references/step-4-vo.md:95 references/step-4-vo.md:101 references/step-4-vo.md:106 references/step-6-validate.md:290 references/step-6-validate.md:132 references/step-6-validate.md:133 references/step-6-validate.md:144
⚙️ 外部コマンド (50)
references/step-1-design.md:65-67 references/step-1-design.md:67-69 references/step-1-design.md:69-70 references/step-1-design.md:70-71 references/step-1-design.md:71-73 references/step-1-design.md:73-75 references/step-1-design.md:75-76 references/step-1-design.md:76-77 references/step-1-design.md:77-78 references/step-1-design.md:78-79 references/step-1-design.md:79-80 references/step-1-design.md:93-94 references/step-1-design.md:94-95 references/step-1-design.md:95-96 references/step-1-design.md:96-97 references/step-1-design.md:97-98 references/step-1-design.md:98-99 references/step-1-design.md:99-100 references/step-1-design.md:100-101 references/step-1-design.md:101-103 references/step-1-design.md:103-105 references/step-1-design.md:126-128 references/step-1-design.md:128-132 references/step-1-design.md:132-142 references/step-1-design.md:213-219 references/step-1-design.md:219 references/step-1-design.md:259-271 references/step-1-design.md:271 references/step-1-design.md:272 references/step-1-design.md:273 references/step-1-design.md:274 references/step-1-design.md:275 references/step-1-design.md:299-302 references/step-5-build.md:308-309 references/step-5-build.md:309-352 references/step-5-build.md:466-469 references/step-6-validate.md:20-21 references/step-6-validate.md:21-24 references/step-6-validate.md:133-140 references/step-6-validate.md:202-210 references/step-6-validate.md:227-231 scripts/w2h-verify.mjs:242 scripts/w2h-verify.mjs:410 scripts/w2h-verify.mjs:510 scripts/w2h-verify.mjs:634 scripts/w2h-verify.mjs:690 scripts/w2h-verify.mjs:54 scripts/w2h-verify.mjs:85 scripts/w2h-verify.mjs:117 scripts/w2h-verify.mjs:127
監査者: codex 監査履歴を表示 →
このレポートを共有・引用
バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。
レポートリンクをコピー
https://skillstore.io/skills/heygen-com-website-to-video/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdownバッジ
[](https://skillstore.io/skills/heygen-com-website-to-video?utm_source=security_passport_badge)HTMLバッジ
<a href="https://skillstore.io/skills/heygen-com-website-to-video?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/heygen-com-website-to-video/security.svg" alt="Skillstore security assessment" loading="lazy"></a>埋め込みカード
<iframe src="https://skillstore.io/embed/skills/heygen-com-website-to-video.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学術引用 (APA · BibTeX · CFF)
APA形式の引用
heygen-com. (2026). website-to-video security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/heygen-com-website-to-video/audits/5BibTeX形式の引用
@techreport{heygen-com-heygen-com-website-to-video-2026,
author = {heygen-com},
title = {website-to-video security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/heygen-com-website-to-video/audits/5},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "website-to-video security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
- name: "heygen-com"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/heygen-com-website-to-video/audits/5"
identifiers:
- type: other
value: "skillstore:heygen-com-website-to-video:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore スコア
このスコアの理由 証拠の信頼度: 中 82
アーキテクチャ
85
保守性
87
コンテンツ
67
コミュニティ
83
仕様準拠
作成できるもの
建立網站導覽
將 landing page 轉成簡短的旁白導覽，說明訊息、視覺識別和主要行動呼籲。
展示作品集
擷取作品集網站，並使用網站素材和語氣製作直式或方形社群短片。
準備客戶影片草稿
建立分鏡、腳本、配音計畫，以及經驗證的 HyperFrames 預覽，供客戶審查。
これらのプロンプトを試す
開始基本網站短片
Use website-to-video to make a 15-second vertical social clip from this URL: <url>. Keep the message simple and use the site assets.
先規劃再建置
Use website-to-video for this site: <url>. First propose the video message, audience, format, duration, and narrative arc before building.
建立旁白導覽
Use website-to-video to create a 30-second narrated site tour from <url>. Ask me to approve the storyboard and script before voiceover.
執行完整驗證
Use website-to-video for <url>. Build the HyperFrames project, run lint, validate snapshots, check audio timing, and report every verification result.
ベストプラクティス
- 擷取前先確認路徑，確保產品發表和不相關的影片任務會使用正確技能。
- 在選擇視覺素材或產生配音前，先鎖定訊息、受眾、格式和敘事弧線。
- 保持擷取素材可見，並在分享最終 Studio 預覽前驗證每個節拍。
回避
- 不要因為啟用了 autonomous mode 就跳過驗證關卡。
- 當有可用的擷取品牌素材時，不要用通用 CSS 重建所有視覺元素。
- 除非所選提供者或快照工作流程需要，否則不要要求 API keys。
よくある質問
此技能適用於哪類網站？
它適用於基於使用者提供 URL 的一般網站導覽、作品集展示、首頁短片和社群影片。
它會自動算繪最終 MP4 嗎？
不會。預設交付內容是 HyperFrames Studio 預覽 URL。只有在提出要求時才會進行 MP4 rendering。
它可以在沒有付費語音提供者的情況下運作嗎？
可以。Kokoro 可在本機執行，用於旁白草稿。HeyGen 和 ElevenLabs 需要使用者提供憑證。
此技能會使用網站上的素材嗎？
會。它會擷取螢幕截圖、標誌、插圖、字型和可見文字，然後用這些內容來引導影片製作。
使用者應該先提供什麼？
請先提供 URL、期望長度、目標格式、受眾，以及影片必須傳達的主要訊息。
哪些任務不在範圍內？
產品發表影片、pull request 影片、沒有網站的主題解說，以及既有影片的剪輯應使用其他工作流程。