Security audit

Hyperframes Media

Security checks for vulnerabilities and agentic risk

Overview

This media skill matches its stated purpose, but it should be reviewed because it can run unpinned external tools, install packages automatically, load broad credentials, and leave background audio jobs running.

Install only if you are comfortable with this skill running Node and Python subprocesses, installing packages, using media provider API keys, and sending media to cloud providers when those paths are chosen. Prefer a dedicated project and virtual environment, expose only the needed environment variables, use pinned local dependencies where possible, avoid sensitive media unless external upload is approved, and monitor or clean up BGM jobs and temp files.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection

Findings (7)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:37
Finding: Mandatory unpinned preflight permits remote influence over agent responses and workflow
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: scripts/lib/bgm.mjs:23
Finding: Background music generation automatically installs unpinned Python packages
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/lib/tts.mjs:252
Finding: Fallback TTS and transcription execute an unversioned npm package
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/lib/heygen.mjs:14
Finding: Credential loader imports unrelated secrets from ancestor .env files
Content: View full analysis
0 ? val.slice(1, end) : val.slice(1); } if (!(key in process.env)) process.env[key] = val; } return; } const parent = dirname(dir); if (parent === dir) break; dir = parent; } } export function heygenCredential() { const envKey = process.env.HEYGEN_API_KEY || process.env.HYPERFRAMES_API_KEY; if (envKey) return { headers: { "X-Api-Key": envKey } }; const file = join(process.env.HEYGEN_CONFIG_DIR || join(homedir(), ".heygen"), "credentials"); ``` ### Technical Analysis The loader searches up to five ancestor directories and imports every assignment from the first `.env` file into the process-wide environment. It does not restrict imported keys to `HEYGEN_API_KEY`, `HYPERFRAMES_API_KEY`, or other media-provider settings. All later Node, Python, pip, `npx`, and detached subprocesses inherit `process.env` by default. Consequently, unrelated database passwords, cloud keys, signing credentials, or deployment secrets ...[truncated 1070 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/lib/tts.mjs:314
Finding: Narration text is left in persistent plaintext temporary files
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/lib/heygen.mjs:102
Finding: Provider-supplied media URLs are downloaded without host, size, or timeout controls
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/lib/bgm.mjs:146
Finding: Detached BGM processes are not terminated after workflow timeout
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Rogue AgentSelf-Modification, Session Persistence

Findings (91)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.
md
- `scripts/heygen-tts.mjs` is a single-shot CLI over the same code (one text → wav + words) for when you just need HeyGen TTS without a request file.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.
md
- `scripts/heygen-tts.mjs` is a single-shot CLI over the same code (one text → wav + words) for when you just need HeyGen TTS without a request file.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.
md
- `scripts/heygen-tts.mjs` is a single-shot CLI over the same code (one text → wav + words) for when you just need HeyGen TTS without a request file.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.
md
- `scripts/heygen-tts.mjs` is a single-shot CLI over the same code (one text → wav + words) for when you just need HeyGen TTS without a request file.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/tts.md (reported line 44)May include surrounding context.
md
// heygen.mjs — vendored HeyGen REST helpers (auth + transport) for the audio // pipeline. The credential resolver is copied from hyperframes-media's // heygen-tts.mjs (and matches the hyperframes CLI auth): first usable source // wins — $HEYGEN_API_KEY / $HYPERFRAMES_API_KEY → a nearby .env → ~/.heygen/ // credentials (oauth → Bearer, else api_key → X-Api-Key; $HEYGEN_CONFIG_DIR // overrides the dir). Vendored so the skill ships standalone. Pure node.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/lib/heygen.mjs (reported line 4)May include surrounding context.
js
// heygen.mjs — vendored HeyGen REST helpers (auth + transport) for the audio // pipeline. The credential resolver is copied from hyperframes-media's // heygen-tts.mjs (and matches the hyperframes CLI auth): first usable source // wins — $HEYGEN_API_KEY / $HYPERFRAMES_API_KEY → a nearby .env → ~/.heygen/ // credentials (oauth → Bearer, else api_key → X-Api-Key; $HEYGEN_CONFIG_DIR // overrides the dir). Vendored so the skill ships standalone. Pure node.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/lib/heygen.mjs (reported line 14)May include surrounding context.
js
// heygen.mjs — vendored HeyGen REST helpers (auth + transport) for the audio // pipeline. The credential resolver is copied from hyperframes-media's // heygen-tts.mjs (and matches the hyperframes CLI auth): first usable source // wins — $HEYGEN_API_KEY / $HYPERFRAMES_API_KEY → a nearby .env → ~/.heygen/ // credentials (oauth → Bearer, else api_key → X-Api-Key; $HEYGEN_CONFIG_DIR // overrides the dir). Vendored so the skill ships standalone. Pure node.

Credential Access

High

Category: Privilege Escalation
Confidence: 68% confidence
Finding: This code walks up to five parent directories and loads the first .env it finds, importing arbitrary key-value pairs into process.env. In shared or untrusted working directories, that can cause credential confusion or unintended secret ingestion from a parent project, increasing the risk of using attacker-controlled API keys or leaking operational context to downstream requests.
Content: Scanner excerpt · scripts/lib/heygen.mjs (reported line 18)May include surrounding context.
js
export function loadEnvFromDir(startDir) { let dir = resolve(startDir); for (let i = 0; i < 5; i++) { const envPath = join(dir, ".env"); if (existsSync(envPath)) { for (const raw of readFileSync(envPath, "utf8").split("\n")) { let line = raw.trim();

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill explicitly instructs use of shell commands and environment-resolved credentials, but it declares no tool restrictions or allowed-tools scope. In systems that honor skill metadata for sandboxing, this can cause the skill to run with broader-than-necessary shell/env access, increasing the chance of command execution or credential exposure if the skill is invoked in an unsafe context.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
Preflight — show sign-in status before any audio

Always run this before generating voice or BGM — inside a full workflow or a one-off "generate me a BGM/voiceover" request. No HeyGen credential is not a reason to silently fall back to local engines: first recommend signing in and let the user decide. Run the shared preflight and relay its output verbatim — don't improvise your own "missing key" prompt, and don't offer to write keys into a per-repo .env:

bash
npx hyperframes auth status

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: Using npx hyperframes auth status without a pinned package version allows whatever version of hyperframes resolves at execution time to run. If the package is updated maliciously, compromised upstream, or subject to dependency confusion in the execution environment, the agent could execute untrusted code during a security-sensitive auth flow.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: A second unpinned npx hyperframes reference appears on the same line in the API-key login example, creating the same supply-chain execution risk. In an agent workflow, even documentation examples can be operationalized verbatim, so an attacker controlling the package resolution path could hijack an auth action.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The unpinned JSON-status command can execute a non-deterministic package version, undermining the skill's claim of deterministic branching. While this invocation is less credential-sensitive than login, it still executes remote code and may produce attacker-controlled output that influences subsequent agent decisions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Recommending npx hyperframes auth login again without version pinning repeats the same remote-code execution and credential interception risk. The danger is amplified because the skill tells the agent to stop and wait around this decision point, making the auth path central to the workflow.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The reference to npx hyperframes tts is also unpinned, so generating audio may execute arbitrary code from an unexpected package version. Although less sensitive than auth, this still grants code execution in the agent environment and may access files, network, or environment variables depending on runtime permissions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The transcription command reference uses unpinned npx, which can fetch and run an unintended package version. In agent environments, documentation often becomes executable instruction, so this creates a real supply-chain risk rather than a purely informational issue.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The background-removal command reference is unpinned and therefore subject to the same package-resolution and remote code execution risks as the other npx examples. Since media-processing tools often touch user-supplied files, compromise could expose local content or alter outputs maliciously.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The TTS-to-captions workflow reference relies on unpinned npx, again allowing execution of whatever package version resolves in the environment. Because this may chain multiple processing steps, a compromised package could tamper with transcripts, captions, or intermediate assets while executing arbitrary code.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/bgm.md (reported line 64)May include surrounding context.
md
## Failure modes | Failure | Behavior | | --------------------------------------------- | ---------------------------------------------------------------------------------------- | | No music match (retrieve) | `bgm: null`, anomaly logged. Render proceeds without BGM. | | Explicit `retrieve`, no credential | Skipped (no silent generate fallback). Use `mode: generate` or omit `mode` for auto. |

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The documentation instructs users to run npx hyperframes ... without pinning an exact package version. npx may fetch the latest published package at execution time, so a compromised upstream release, typosquatted package, or unexpected breaking change could result in unreviewed code being executed on the user's machine.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This command uses npx hyperframes add ... with no version pin, which can download and execute whatever version is current at the time of use. In a skill context, examples are often copied verbatim, so this increases supply-chain risk and makes builds non-reproducible.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The unpinned npx hyperframes catalog --tag caption-style example allows remote package resolution at runtime, which can lead to execution of a malicious or altered package version. Because this file is instructional documentation, the risk is indirect but real: users may execute the command in trusted environments based solely on the example.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file instructs users to upload local audio to third-party transcription APIs and send API bearer tokens, but it provides no explicit warning that transcript content and raw media leave the local environment. In a media workflow, audio commonly contains sensitive voice, personal data, or unpublished content, so omission of a privacy/data-sharing notice can cause unintentional disclosure.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: This command explicitly transmits audio.mp3 and an API credential to OpenAI's external service. The transmission is intentional and functionally necessary, but in this skill context it still creates a real confidentiality risk because media assets may contain sensitive speech, licensed material, or internal recordings.
Content: Scanner excerpt · references/captions/transcript-handling.md (reported line 70)May include surrounding context.
bash
# Generate with word timestamps, then import curl https://api.openai.com/v1/audio/transcriptions \ -H "Authorization: Bearer $OPENAI_API_KEY" \ -F file=@audio.mp3 -F model=whisper-1 \ -F response_format=verbose_json \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: This example sends local audio and a bearer token to Groq's external API endpoint. Although expected for cloud transcription, it is still a genuine data-exposure pathway, and the skill context increases relevance because transcription inputs are often raw user recordings that may contain personal or confidential information.
Content: Scanner excerpt · references/captions/transcript-handling.md (reported line 83)May include surrounding context.
Groq Whisper API (fast, free tier available):

bash
curl https://api.groq.com/openai/v1/audio/transcriptions \ -H "Authorization: Bearer $GROQ_API_KEY" \ -F file=@audio.mp3 -F model=whisper-large-v3 \ -F response_format=verbose_json \

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/lib/bgm.mjs:31

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/lib/python.mjs:7

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/lib/tts.mjs:30

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/lib/tts.spawn.test.mjs:11

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/lib/heygen.mjs:33

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/lib/tts.mjs:28

Overview

A.I.G

T01 · Skill Instruction Hijacking

T08 · Insecure Dependencies

T03 · Remote Payload Retrieval and Execution

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Ae1

Ae1

Ae1

Ae1

Credential Access

Credential Access

Credential Access

Credential Access

Undeclared Tool Scope

Session Persistence

Preflight — show sign-in status before any audio

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Whitespace Padding

Rp1

Rp1

Rp1

Missing User Warnings

External Transmission

External Transmission

Static analysis

Shell command execution detected (child_process).

Shell command execution detected (child_process).

Shell command execution detected (child_process).

Shell command execution detected (child_process).

Environment variable access combined with network send.

Environment variable access combined with network send.