Security audit
Security checks for vulnerabilities and agentic risk
The skill matches its video-building purpose, but it runs mutable external HyperFrames commands that can update skills and install blocks, so it needs review before installation.
Install only if you trust the HyperFrames package/registry and are comfortable with URL capture, media-service credentials, preference persistence, background preview/render processes, and possible global skill updates. Prefer a sandboxed workspace with limited environment secrets and verify or pin the HyperFrames CLI before use.
Referenced artifact was not completely inspected
**Gate:** `build-frame.mjs` exited 0 — `frame.md` exists from a named preset, and (when the preset ships one) `.hyperframes/caption-skin.html` exists as the cap
Referenced artifact was not completely inspected
dio. That combination marks the project silent — no narration, no BGM, no SFX. `audio.mjs` recognizes it and generates nothing (it removes any stale `audio_meta
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
const videos = [];
const errors = [];
const scan = html
.replace(/<!--[\s\S]*?-->/g, (match) => " ".repeat(match.length))
.replace(/<script\b[\s\S]*?<\/script[^>]*>/gi, (match) => " ".repeat(match.length))
.replace(/<style\b[\s\S]*?<\/style[^>]*>/gi, (match) => " ".repeat(match.length));
const re = /<video\b((?:[^>"']|"[^"]*"|'[^']*')*)>([\s\S]*?)<\/video\s*>/gi;
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
let captionsEmitted = false;
if (existsSync(join(hyperframesDir, "compositions/captions.html"))) {
body.push(
` <!-- captions -->`,
` <div`,
` id="el-captions"`,
` class="scene"`,
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
const result = spawnSync(
process.execPath,
[script, "--hyperframes", dir, "--storyboard", join(dir, "STORYBOARD.md"), ...args],
{ encoding: "utf8", env: { ...process.env, HF_MEDIA_ENGINE: engine, ...env } },
);
assert.equal(result.status, 0, result.stderr);
return JSON.parse(readFileSync(join(dir, "request.json"), "utf8"));
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
assert.match(result.stderr + result.stdout, /pending/i);
});
test("fetch-sfx: a resolved bed reports bgm_pending false and no warning", () => {
const { dir, result } = runFetchSfx({
storyboard: FRAME_WITH_SFX("whoosh"),
neutralOut: { voices: [], bgm: { path: "assets/bgm/track.mp3", volume: 0.12 }, sfx: [] },
The skill invokes commands, reads environment-dependent credentials, and makes decisions based on variables like API keys and auth state, but it declares no explicit tool scope or allowed-tools boundary. In a skill system, missing scope increases the blast radius because the agent may access more tools or environment data than the workflow actually needs, making unintended secret exposure or broader execution more likely.
The skill description is intentionally broad and routes 'the default for any commercial URL' to this workflow, which can cause over-triggering on loosely related user input. Overbroad auto-routing is risky because it can cause the agent to perform network capture, asset collection, and external tool execution on inputs the user did not clearly intend for this high-capability workflow.
The skill instructs the agent to run npx hyperframes ... without pinning an exact package version or immutable source. That creates a supply-chain risk: the behavior may change over time, or a compromised/upstream package version could execute attacker-controlled code during install or runtime.
The skill instructs the system to make the brief durable, resume from existing project files, and record preference-backed answers across runs. Persisting user briefs and preferences can be legitimate, but without explicit minimization and consent controls it increases privacy and cross-session data-leak risk, especially when marketing inputs may include unpublished launch details or sensitive brand assets.
## Step 0: Setup
Goal: Enter with a confirmed brief, create the HyperFrames project, and make the brief durable.
**The brief is confirmed by the intent layer, not by questions asked here.** Opening rule, in order: **(1)** `BRIEF.md` exists → read it and ask nothing — the brief is settled, and its `flow`/`storyboard` derive the mode (brief contract § 1). **(2)** No `BRIEF.md` but the project exists (`hyperframes.json` / `STORYBOARD.md` on disk) → resume from the storyboard's frontmatter and the recorded preferences; never re-interrogate a half-built project. **(3)** Neither — a fresh creation request that arrived here directly → read `/hyperframes` and run its intent layer (`references/intent-interview.md`): it checks recipes and remembered defaults, conducts this route's questions (`../hyperframes/references/routes/product-launch-video.md`), and hands back the locked brief. Edit requests skip all of this — go do the edit.
This invocation again relies on an unpinned npx hyperframes package, allowing code from the current registry state to be fetched and executed. In an automated agent workflow, repeated unpinned executions compound the risk because multiple stages depend on mutable external code.
Running npx hyperframes auth status without version pinning still executes mutable remote package code before checking authentication state. Even seemingly read-only status commands can become code-execution vectors if the fetched package is replaced or trojaned.
The capture step uses an unpinned npx hyperframes command against attacker-influenced URLs, which combines supply-chain exposure with untrusted input processing. If the package or its dependencies are compromised, the capture stage could exfiltrate data or run arbitrary code while handling external content.
The skill explicitly allows autonomous progression in some modes ('there is nothing to ask ... proceed'), including drafting persuasive marketing content and selecting assets without user confirmation at that stage. While not inherently malicious, this reduces human oversight for externally visible outputs and can amplify harmful or unauthorized actions if the initial brief or routing was wrong.
Read `../hyperframes-creative/references/story-spine.md` (hook language, value-before-evidence, storyboard-as-proposal, source-traceable visuals), `references/story-design.md`, `../hyperframes-animation/blueprints-index.md`, `../hyperframes/references/storyboard-format.md`, and `../hyperframes/references/script-format.md`. Use them to write `STORYBOARD.md` and, when narration is needed, `SCRIPT.md`. Set the frontmatter `duration:` from the brief's `length` — a rough expectation; assembly reports where the cut lands against it.
Use `story-design.md` for story blueprint, hook, persuasion logic, beats, `VO_MODE`, and asset choices. As a **soft guide**, consult the role→blueprint menu in `../hyperframes-animation/blueprints-index.md`: for each beat, note a candidate blueprint id when one fits. Story truth still decides which beats exist — never force a beat to fit a blueprint, and never invent a beat just because a proven shape is available. Choose each visual frame's `asset_candidates` from `capture/extracted/asset-descriptions.md` (the canonical inventory) — don't browse raw `capture/assets/`. Do not ask the user to pick assets unless that inventory is missing or unusable. Use the exact required fields from the storyboard and script references.
After drafting, run the review loop's plan pass — `../hyperframes/references/review-loop.md` § 1: present the plan as a proposal, and ask the two questions — approve or change, and **sketches first** (recommended) or skip. Feedback arrives as a chat reply; loop until approved. This is a **checkpoint gate** (brief contract § 1): in autonomous mode there is nothing to ask — post the same summary as a heads-up and proceed; sketches collapse into the build, and the final preview with its one question comes at Step 6.
The catalog lookup executes npx hyperframes without a fixed version, so dependency resolution remains mutable and externally controlled. Because this step influences later asset/component selection, compromise here can taint downstream output and execution paths.
Pre-installing blocks via unpinned npx hyperframes add introduces both package and content supply-chain risk, since the skill directs the agent to fetch and install named registry blocks before worker dispatch. A malicious or altered upstream package or registry artifact could lead to arbitrary code or unsafe generated content entering the project.
The lint command uses an unpinned package invocation, meaning even verification steps depend on mutable external code. Attackers often abuse trusted validation phases because they are less scrutinized yet still run with project access.
The check command repeats the same unpinned execution pattern, exposing the workflow to arbitrary upstream changes or compromise. Because it runs late in the pipeline, it may have access to assembled project artifacts, credentials, and generated media metadata.
Snapshot generation via unpinned npx hyperframes again executes mutable code fetched at runtime. Since snapshots operate over final artifacts, compromise can expose sensitive project contents or alter review evidence.
The preview command is another unpinned runtime package execution, increasing supply-chain and arbitrary-code-execution risk. Background preview services may also open ports or processes, making compromise more operationally dangerous.
Final rendering uses an unpinned npx hyperframes invocation, so the most privileged and artifact-rich stage depends on mutable upstream code. This is particularly dangerous because render stages often process all project inputs and produce deliverables, providing a high-value point for tampering or exfiltration.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
The reusable, product-agnostic shot shapes live in `../hyperframes-animation/blueprints/` (indexed by `../hyperframes-animation/blueprints-index.md`).
| Read | When |
| ----------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- |
| `[../hyperframes/references/brief-contract.md](../hyperframes/references/brief-contract.md)` | Gate types, mode derivation from `BRIEF.md`, field semantics. |
| `[../hyperframes-creative/references/story-spine.md](../hyperframes-creative/references/story-spine.md)` | Step 3: story doctrine — hook language, value-before-evidence, proposal shape, source-traceable visuals. |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
The reusable, product-agnostic shot shapes live in `../hyperframes-animation/blueprints/` (indexed by `../hyperframes-animation/blueprints-index.md`).
| Read | When |
| ----------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- |
| `[../hyperframes/references/brief-contract.md](../hyperframes/references/brief-contract.md)` | Gate types, mode derivation from `BRIEF.md`, field semantics. |
| `[../hyperframes-creative/references/story-spine.md](../hyperframes-creative/references/story-spine.md)` | Step 3: story doctrine — hook language, value-before-evidence, proposal shape, source-traceable visuals. |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| `[../hyperframes-creative/references/story-spine.md](../hyperframes-creative/references/story-spine.md)` | Step 3: story doctrine — hook language, value-before-evidence, proposal shape, source-traceable visuals. |
| `[../hyperframes-creative/frame-presets/](../hyperframes-creative/frame-presets/)` | Step 2: choose and adopt a frame preset. |
| `[../hyperframes-creative/references/design-spec.md](../hyperframes-creative/references/design-spec.md)` | Step 2: apply brand tokens correctly. |
| `[references/story-design.md](references/story-design.md)` | Step 3: plan the product-launch story. |
| `[../hyperframes-animation/blueprints-index.md](../hyperframes-animation/blueprints-index.md)` | Step 3: role→blueprint menu. Step 4: pick the shot shape. |
| `[../hyperframes/references/storyboard-format.md](../hyperframes/references/storyboard-format.md)` | Step 3: write `STORYBOARD.md`. |
| `[../hyperframes/references/script-format.md](../hyperframes/references/script-format.md)` | Step 3: write `SCRIPT.md`. |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| `[../hyperframes-creative/references/story-spine.md](../hyperframes-creative/references/story-spine.md)` | Step 3: story doctrine — hook language, value-before-evidence, proposal shape, source-traceable visuals. |
| `[../hyperframes-creative/frame-presets/](../hyperframes-creative/frame-presets/)` | Step 2: choose and adopt a frame preset. |
| `[../hyperframes-creative/references/design-spec.md](../hyperframes-creative/references/design-spec.md)` | Step 2: apply brand tokens correctly. |
| `[references/story-design.md](references/story-design.md)` | Step 3: plan the product-launch story. |
| `[../hyperframes-animation/blueprints-index.md](../hyperframes-animation/blueprints-index.md)` | Step 3: role→blueprint menu. Step 4: pick the shot shape. |
| `[../hyperframes/references/storyboard-format.md](../hyperframes/references/storyboard-format.md)` | Step 3: write `STORYBOARD.md`. |
| `[../hyperframes/references/script-format.md](../hyperframes/references/script-format.md)` | Step 3: write `SCRIPT.md`. |
Detected: suspicious.dangerous_exec