Security audit
Security checks for vulnerabilities and agentic risk
This video-making skill needs review because it directs automatic public feedback and access to coding-agent credentials without a separate opt-in.
Before installing, require explicit approval for public feedback and coding-agent account checks. Disable feedback with HYPERFRAMES_NO_TELEMETRY=1 if unwanted, use --skip-skills to avoid installing the additional skill pack, and run a reviewed, pinned CLI version. Approve cloud uploads and infrastructure changes deliberately.
The automatic feedback instruction can submit qualitative information about user requests without a task-specific approval or privacy check. This duplicates the other feedback mismatch finding and the SQP-2 finding, rather than establishing a separate high-severity issue.
The declared purpose includes cloud rendering and troubleshooting, but does not disclose infrastructure destruction. Invoking the lambda destroy subcommand is a materially distinct destructive capability, not merely a supporting implementation detail of rendering.
These are distinct media-generation and processing capabilities not included in the declared workflow list. Although they use the same CLI, the supplied commands do not merely implement the described project-management, editing, or rendering operations. The chunk does not establish what inputs, external services, or permissions these commands use.
The security concern is not merely an incomplete description: the workflow directs automatic feedback and reporting about unmet user requests after rendering. That can disclose user-request details beyond the requested media task without a consent or redaction step; the telemetry-off exception reduces but does not eliminate this risk.
The supplied command installs AI-tool skills rather than performing the declared project and rendering workflows. This is a distinct installation capability not mentioned in the description, and the supplied chunk does not establish it as a necessary supporting step for those workflows.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
npx hyperframes cloud list # recent renders (--limit, --token, --all)
npx hyperframes cloud get hfr_def456 # full detail + short-lived signed video_url
npx hyperframes cloud delete hfr_def456 # soft-delete (--no-confirm to skip the prompt)
video_url and thumbnail_url are short-lived presigned URLs, so re-fetch with cloud get rather than caching them.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## Prerequisites
- AWS credentials configured (env vars, `~/.aws/credentials`, SSO, or IMDS).
- AWS SAM CLI on `PATH`.
- `bun` on `PATH` (builds the Lambda handler ZIP).
This references a CLI, not an MCP server, but the underlying dependency risk is real: unversioned npx can download and execute an unreviewed package release when no suitable local installation exists. The project-wrapper exception reduces exposure in some projects but does not secure the default execution path.
The routine lint step invokes an unversioned executable through npx, which can fetch an unreviewed release if a suitable local package is absent. Although linting is legitimate, a compromised package would execute with the agent's permissions; this is another occurrence of the same dependency-control issue.
The mandatory check step uses unversioned npx execution, potentially retrieving a package release that has not been reviewed. Its role as a validation gate does not make the executable trustworthy, and this repeats the same supply-chain exposure as the default command.
The snapshot command can resolve an unreviewed package through npx when no suitable local installation is available. Inspecting generated images is normal for this skill, but it does not mitigate the risk of executing compromised dependency code first.
The preview step invokes HyperFrames without an explicit version or guaranteed pinned local dependency. Starting a preview is expected behavior, but the execution mechanism can introduce unreviewed package code; this is not evidence of an MCP-specific problem.
The render instruction uses unversioned npx, allowing execution of an unreviewed release if a suitable local dependency is unavailable. The explicit condition on when to render limits unwanted rendering, but it does not address the dependency's provenance or reproducibility.
Even this read-oriented selection query executes the HyperFrames package, and the unversioned npx form can fetch unreviewed code. The apparently limited purpose of reading preview context does not constrain what a compromised executable could do.
The start-of-turn history command makes unversioned package execution part of routine agent activity. This increases opportunities to encounter an unreviewed release, although it is the same underlying dependency risk rather than an independent exploit.
The skill explicitly directs post-render feedback plus a report about capabilities the user requested, without specifying consent, redaction, or a payload review. Such reporting could expose sensitive requirements or business context; the telemetry-off exception helps, but the referenced feedback implementation and actual transmitted fields are not provided.
The browser-recovery instruction can invoke an unreviewed HyperFrames release through unversioned npx. Installing or repairing a browser is legitimate troubleshooting, but it does not justify bypassing dependency version controls.
The unversioned npx command can fetch and execute an unreviewed package release when no suitable local installation exists. This is a CLI rather than an MCP server, but the underlying supply-chain risk remains: a compromised release could execute with the agent's filesystem and environment access.
Specifying a project directory does not constrain the version of code npx executes. Without a locked local dependency, this command can obtain a changing registry release that could read or modify project files if compromised.
The JSON output flag does not mitigate the unpinned executable dependency. If npx downloads a compromised release, that code runs with the agent's privileges before producing any output.
The audio-analysis example invokes hyperframes without establishing a trusted package version. Where npx fetches the package, a malicious upstream release could access the supplied media and other resources available to the agent.
The troubleshooting command can introduce unreviewed executable code while diagnosing a missing dependency. Its diagnostic purpose does not prevent a compromised package release from accessing local files or credentials.
This is an unpinned npm CLI invocation, not an MCP server reference as the scanner claims. If the package is unavailable locally, npx may download a mutable release; a compromised release would execute with the user's permissions during authentication and could access credentials.
The cloud-render command uses an unpinned npm package that npx may download when no suitable local installation exists. A compromised release could execute locally and access project files and cloud credentials; the documented upload itself is expected functionality, not evidence of malicious exfiltration.
The OAuth login example executes hyperframes without specifying a trusted version. If npx resolves a compromised release, that code runs locally in an authentication workflow and could intercept or misuse the resulting session.
No suspicious patterns detected.