Security audit

hyperframes

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherently aimed at building HyperFrames videos, but it can automatically fetch/update remote CLI packages and workflow skills and modify project dependencies without explicit user approval.

Install only if you are comfortable with the skill running HyperFrames CLI commands, downloading workflow updates, writing project files, recording limited confirmed preferences, and potentially changing project dependency pins. Prefer the plugin-managed mode or require explicit approval before standalone updates, skill refreshes, publishing, or dependency changes.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (98)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.
md
| No brief, but `hyperframes.json` or `STORYBOARD.md` exists | Resume from project files and recorded preferences. Infer the owning workflow from existing artifacts. If it cannot be determined uniquely, ask one routing-only question; do not run the intent interview. | | Fresh creation | Run the intent layer — `references/intent-interview.md` — then route once using § 2's table. |  When you edit an existing project, bracket your edits with project history (`/hyperframes-cli`, Project history in your turn).

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.
md
A scaffolded project pins `hyperframes@<version>` in its `package.json` scripts so renders stay reproducible; the pin never advances on its own, and a pinned run of an older CLI prints no warning about it. When resuming a project whose scripts carry a pin, probe once before the first render-affecting command:

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill directs the agent to run multiple CLI commands and perform updates, renders, and inspections, but it does not declare an explicit tool/permission scope. That creates an authority gap where a host may permit broader execution than intended, increasing the chance of unreviewed command execution or environment access during handling of untrusted project inputs.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.
md
Apply the first matching row; do not evaluate lower state rows: | State | Action | | ----------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Explicit port of existing Remotion source to HyperFrames | Read `references/routes/remotion-to-hyperframes.md`, then route directly to that workflow. Skip the intent layer. | | Specific operation on an existing HyperFrames project: inspect, diagnose, validate, preview, render, publish, or batch-render | Perform only that operation. Skip intent and workflow routing; load `/hyperframes-cli` and any required domain skills. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.
md
| State | Action | | ----------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Explicit port of existing Remotion source to HyperFrames | Read `references/routes/remotion-to-hyperframes.md`, then route directly to that workflow. Skip the intent layer. | | Specific operation on an existing HyperFrames project: inspect, diagnose, validate, preview, render, publish, or batch-render | Perform only that operation. Skip intent and workflow routing; load `/hyperframes-cli` and any required domain skills. | | A question, a hold, an idea with no concrete change, or a felt note on a built film, in an existing project | Follow `/hyperframes-studio` § 0. | | A new film asked for inside an existing project | Follow `/hyperframes-studio` § 5. ...[truncated 25 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.
md
| ----------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Explicit port of existing Remotion source to HyperFrames | Read `references/routes/remotion-to-hyperframes.md`, then route directly to that workflow. Skip the intent layer. | | Specific operation on an existing HyperFrames project: inspect, diagnose, validate, preview, render, publish, or batch-render | Perform only that operation. Skip intent and workflow routing; load `/hyperframes-cli` and any required domain skills. | | A question, a hold, an idea with no concrete change, or a felt note on a built film, in an existing project | Follow `/hyperframes-studio` § 0. | | A new film asked for inside an existing project | Follow `/hyperframes-studio` § 5. | | Specific edit to an existing project | Make the edit. Do not run the intent layer. To know wha ...[truncated 25 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.
md
| ----------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Explicit port of existing Remotion source to HyperFrames | Read `references/routes/remotion-to-hyperframes.md`, then route directly to that workflow. Skip the intent layer. | | Specific operation on an existing HyperFrames project: inspect, diagnose, validate, preview, render, publish, or batch-render | Perform only that operation. Skip intent and workflow routing; load `/hyperframes-cli` and any required domain skills. | | A question, a hold, an idea with no concrete change, or a felt note on a built film, in an existing project | Follow `/hyperframes-studio` § 0. | | A new film asked for inside an existing project | Follow `/hyperframes-studio` § 5. | | Specific edit to an existing project | Make the edit. Do not run the intent layer. To know wha ...[truncated 25 chars]

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs use of npx hyperframes timeline [--json] without pinning a version, so execution depends on whatever package version resolves at runtime. In a supply-chain compromise or unexpected upstream release, the agent could fetch and execute malicious code while analyzing or editing a project.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.
md
| A question, a hold, an idea with no concrete change, or a felt note on a built film, in an existing project | Follow `/hyperframes-studio` § 0. | | A new film asked for inside an existing project | Follow `/hyperframes-studio` § 5. | | Specific edit to an existing project | Make the edit. Do not run the intent layer. To know what is on a project's timeline (tracks, clips, starts, ends, what plays), run `npx hyperframes timeline [--json]` instead of reading `index.html` and every sub-composition file. | | `BRIEF.md` exists | Read `workflow` and `flow`. Execute that workflow; `flow: companion` always executes in `/general-video`. Ask no brief questions. | | No brief, but `hyperframes.json` or `STORYBOARD.md` exists | Resume from project files and recorded preferences. Infer the owning workflow from existing artifacts. If it cannot be determined uniquely, ask one routing-only question; do not run the intent interview. | | Fresh creation | Run the intent layer — `references/intent-interview.md` ...[truncated 25 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.
md
| Specific edit to an existing project | Make the edit. Do not run the intent layer. To know what is on a project's timeline (tracks, clips, starts, ends, what plays), run `npx hyperframes timeline [--json]` instead of reading `index.html` and every sub-composition file. | | `BRIEF.md` exists | Read `workflow` and `flow`. Execute that workflow; `flow: companion` always executes in `/general-video`. Ask no brief questions. | | No brief, but `hyperframes.json` or `STORYBOARD.md` exists | Resume from project files and recorded preferences. Infer the owning workflow from existing artifacts. If it cannot be determined uniquely, ask one routing-only question; do not run the intent interview. | | Fresh creation | Run the intent layer — `references/intent-interview.md` — then route once using § 2's table. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.
md
| Specific edit to an existing project | Make the edit. Do not run the intent layer. To know what is on a project's timeline (tracks, clips, starts, ends, what plays), run `npx hyperframes timeline [--json]` instead of reading `index.html` and every sub-composition file. | | `BRIEF.md` exists | Read `workflow` and `flow`. Execute that workflow; `flow: companion` always executes in `/general-video`. Ask no brief questions. | | No brief, but `hyperframes.json` or `STORYBOARD.md` exists | Resume from project files and recorded preferences. Infer the owning workflow from existing artifacts. If it cannot be determined uniquely, ask one routing-only question; do not run the intent interview. | | Fresh creation | Run the intent layer — `references/intent-interview.md` — then route once using § 2's table. |

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 88% confidence
Finding: The skill instructs the agent to automatically upgrade the CLI, verify it, revert on failure, and 'act on the signal rather than relaying it to the user.' That grants the agent autonomy to change project dependencies and execution behavior without explicit approval, which is risky in a skill that handles untrusted inputs and remote package installation.
Content: Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.
npx hyperframes@latest upgrade --project . --check

text
The probe is read-only and reports the pin against the latest release; keep the explicit `.` — on older CLI releases a bare `--project` followed by another flag consumes that flag as its directory value. When it reports the project behind — or any CLI output already shows it (the stderr notice `This project pins hyperframes@… (latest …)`, or `_meta.updateAvailable: true` in a `--json` result from a pinned script) — apply with `npx hyperframes@latest upgrade --project .`, then verify with `npx hyperframes check`. A passing check confirms the project's compositions still validate on the new version — not that rendered output is frame-identical to the old pin — so a successful bump is never silent: name the old and new version in the run's summary. A project with no composition yet needs no verification. If the check fails, revert the `package.json` change, continue on the pinned version, and report which version the project stays on and why. Act on the signal rather than relaying it to the user; never leave a bumped pin unverified. ## 2. Route fresh creation

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.
md
Use the first matching row. Match the requested **deliverable**, not a word or file type mentioned in passing. | Priority | Request | Workflow | | -------- | ------------------------------------------------------------------------------------------------------------------ | -------------------------- | | 1 | Explicitly port an existing Remotion source | `/remotion-to-hyperframes` | | 2 | Author a presentation, pitch deck, or navigable interactive deck | `/slideshow` |

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The skill directs npx hyperframes skills update <workflow-name>, which fetches and executes code from a remote package name without an exact version. Because this step precedes reading the selected workflow, it creates a strong supply-chain execution point where compromised or unexpected upstream content could control subsequent behavior.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.
md
## 5. Load domain skills on demand | Need | Skill | | ------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ | | Composition structure, timing attributes, tracks, variables, determinism | `/hyperframes-core` | | Motion rules, scene blueprints, transitions, runtime adapters | `/hyperframes-animation` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.
md
| Images, icons, logos, audio, captions, grades, LUTs, reusable media | `/media-use` | | Voiceover carve, audio effect chains, automation envelopes, or one chain/fader across several tracks (submix bus) | `/hyperframes-audio` | | Init, lint, check, snapshots, compare, batch render, Studio, render, publish, or diagnostics | `/hyperframes-cli` | | Registry blocks and components | `/hyperframes-registry` | | A named look, effect, treatment, or transition — CRT scanlines, glitch, film grain, shimmer sweep, confetti burst — BEFORE hand-building it | `/hyperframes-registry` | | Figma assets, tokens, components, or storyboard frames as reconstructed motion | `/figma` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.
md
Creator edit phrases are cross-domain requests. Load every skill named in the matching row: | Creator request | Required domains | | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | “cut this footage”, hard cut, trim, splice, reorder, or use a source range | `/general-video` + `/hyperframes-core`; core owns `data-start`, `data-duration`, `data-media-start`, and track layout. | | zoom in here, punch-in / punch-out, smooth multi-state zoom or reframe, Ken Burns, or camera move | `/general-video` + `/hyperframes-core` + `/hyperframes-keyframes`; animate the inner visual/crop wrapper, not the timed clip. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.
md
Creator edit phrases are cross-domain requests. Load every skill named in the matching row: | Creator request | Required domains | | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | “cut this footage”, hard cut, trim, splice, reorder, or use a source range | `/general-video` + `/hyperframes-core`; core owns `data-start`, `data-duration`, `data-media-start`, and track layout. | | zoom in here, punch-in / punch-out, smooth multi-state zoom or reframe, Ken Burns, or camera move | `/general-video` + `/hyperframes-core` + `/hyperframes-keyframes`; animate the inner visual/crop wrapper, not the timed clip. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.
md
Three terms describe different concerns. Do not substitute one for another. | Term | Values | Owns | | ------------ | ------------------------------- | --------------------------------------------------------------------------------------------- | | `flow` | `automation` or `companion` | Who drives execution. `companion` always executes in `/general-video`. | | `storyboard` | `yes` or `no` | Whether the plan and layouts are reviewed before building (`review-loop.md`). |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/brief-contract.md (reported line 15)May include surrounding context.
md
Three terms describe different concerns. Do not substitute one for another. | Term | Values | Owns | | ------------ | ------------------------------- | --------------------------------------------------------------------------------------------- | | `flow` | `automation` or `companion` | Who drives execution. `companion` always executes in `/general-video`. | | `storyboard` | `yes` or `no` | Whether the plan and layouts are reviewed before building (`review-loop.md`). |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/script-format.md (reported line 19)May include surrounding context.
md
Three terms describe different concerns. Do not substitute one for another. | Term | Values | Owns | | ------------ | ------------------------------- | --------------------------------------------------------------------------------------------- | | `flow` | `automation` or `companion` | Who drives execution. `companion` always executes in `/general-video`. | | `storyboard` | `yes` or `no` | Whether the plan and layouts are reviewed before building (`review-loop.md`). |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/brief-contract.md (reported line 70)May include surrounding context.
md
| `destination` | Where the video will play | Infer from the request. Ask only when unknown and the answer changes aspect, type scale, or composition. | | `aspect` | Canvas size | Derive from destination: social feed → `1080x1080`; TikTok/Reels/Shorts → `1080x1920`; YouTube/website/desktop → `1920x1080`. State the derivation. | | `length` | Target duration | Let the workflow recommend a range supported by the material; include the reason. | | `language` | Narration and caption language | Use the user's language and state it. | | `audience` | Who will watch | Infer when clear. Ask only when a different answer changes the story or terminology. | | `message` | The one thing the video must communicate | Derive and echo one sentence. Do not storyboard until this is clear. | | `angle` | Route-specific story shape | Recommend one route-defined option with a reason. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/brief-contract.md (reported line 72)May include surrounding context.
md
| `length` | Target duration | Let the workflow recommend a range supported by the material; include the reason. | | `language` | Narration and caption language | Use the user's language and state it. | | `audience` | Who will watch | Infer when clear. Ask only when a different answer changes the story or terminology. | | `message` | The one thing the video must communicate | Derive and echo one sentence. Do not storyboard until this is clear. | | `angle` | Route-specific story shape | Recommend one route-defined option with a reason. | | `narration` | `yes`, `minimal`, or `no`, plus route-specific modes | Follow the selected route. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/brief-contract.md (reported line 73)May include surrounding context.
md
| `language` | Narration and caption language | Use the user's language and state it. | | `audience` | Who will watch | Infer when clear. Ask only when a different answer changes the story or terminology. | | `message` | The one thing the video must communicate | Derive and echo one sentence. Do not storyboard until this is clear. | | `angle` | Route-specific story shape | Recommend one route-defined option with a reason. | | `narration` | `yes`, `minimal`, or `no`, plus route-specific modes | Follow the selected route. | ### Remembered defaults

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/brief-contract.md (reported line 74)May include surrounding context.
md
| `audience` | Who will watch | Infer when clear. Ask only when a different answer changes the story or terminology. | | `message` | The one thing the video must communicate | Derive and echo one sentence. Do not storyboard until this is clear. | | `angle` | Route-specific story shape | Recommend one route-defined option with a reason. | | `narration` | `yes`, `minimal`, or `no`, plus route-specific modes | Follow the selected route. | ### Remembered defaults

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/plugin-cli.mjs:77

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/plugin-cli.test.mjs:104