Website To Video

• Outcome: Review
• Latest audit: Jul 10, 2026 · 11:00 PM UTC
• Version: 1.0.7

Overview

This skill mostly matches a website-to-video workflow, but it silently updates itself and tells users to paste API keys into chat.

Install only if you are comfortable reviewing the update step yourself, declining silent updates, and configuring any API keys through a safer secret mechanism instead of chat. Avoid using it on authenticated or sensitive websites unless you understand what screenshots, assets, and extracted design data will be saved locally.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The capability statement explicitly tells the agent it is not limited to captured website content and may use arbitrary browser APIs, downloaded registry blocks, and custom scenes. For a skill whose declared purpose is turning a website into a showcase video, this materially expands behavior beyond least-privilege and can enable unrelated content generation or external retrieval that a user did not intend.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: Including broad media features such as TTS, transcription, and background removal extends the effective capability surface far beyond a simple website-tour video skill. In context, this increases the chance an agent will invoke unrelated processing on additional media or generate synthetic narration without clear user consent, creating scope expansion and data-handling risk.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file opens by stating 'Marketing videos are made concept-first,' which reframes the skill as a general marketing-video workflow rather than a website-to-video showcase tool. Because downstream agents often follow reference docs literally, this can steer execution into generating promotional or launch-style content that the manifest explicitly says this skill should not handle.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The concept template includes 'Why this matters now' with examples such as launch, feature ship, and brand reposition, directly inviting product-launch and announcement framing. That contradicts the skill metadata and can cause the agent to produce disallowed marketing narratives under the guise of storyboard planning.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The pacing matrix explicitly maps 'launch' and 'announcement' requests to an 'Arc' narrative, which operationalizes prohibited use cases instead of rejecting or rerouting them. In skill systems, concrete decision tables are highly influential, so this materially increases the chance that the agent will ignore the manifest boundary and create product-launch/promo content.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The skill explicitly instructs the agent to ask users to paste third-party API keys into chat and then use them directly. Secrets pasted into chat can be retained in logs, transcripts, analytics, or exposed to other tools in the agent workflow, turning a normal setup step into credential collection through an unsafe channel.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly instructs the agent to run `npx hyperframes skills update website-to-video` silently and without asking the user. This causes unreviewed code or prompt content to be fetched and executed before the rest of the workflow, creating a supply-chain and prompt-injection risk because the behavior of the skill can change outside the user's awareness or consent.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The capture command is described as collecting screenshots, site assets, and design tokens without any visible warning, consent guidance, or data-sensitivity limitations. Because website capture can ingest copyrighted assets, tokens embedded in page styling, or private content visible to the browser session, missing disclosure and guardrails creates a meaningful privacy and data-governance risk.

Missing User Warnings

Low

• Confidence: 76% confidence
• Finding: The skill instructs the agent to download and store full website capture artifacts locally without explicitly warning the user that site content, screenshots, assets, and extracted data will be written to disk. In environments with sensitive targets, shared workspaces, or regulated data handling requirements, this can lead to unintended retention or exposure of third-party content and metadata.

Missing User Warnings

High

• Confidence: 100% confidence
• Finding: The text not only allows but normalizes direct secret sharing by saying to not judge or critique if the user pastes a key in chat and to just use it. This suppresses normal safety friction and increases the chance that users disclose sensitive credentials into an insecure conversational channel.

Ssd 3

High

• Confidence: 100% confidence
• Finding: The skill instructs the agent to solicit credentials in chat and operationally consume them, which is a direct secret-handling flaw. If followed, the agent becomes a collection point for API keys, and compromise of chat history or downstream tooling could expose those credentials for unauthorized API use.

Scope Creep

Low

• Category: Excessive Agency

Content

> **How to read this file.** Scan the **Table of Contents** below first. **Do NOT read this file linearly** — it is a 700+ line inventory; reading top-to-bottom every session wastes context. When the storyboard or a specific beat needs a particular capability (HTML-in-Canvas, shader transitions, audio-reactive, dynamic counters, etc.), jump straight to that section.

You are NOT limited to what was captured from the website. You can create shaders from scratch, search for and download registry blocks, build Three.js scenes, write custom WebGL effects, use any web API — anything a browser can render.

For implementation patterns (working code), see `techniques.md`. This file is the WHAT; techniques.md is the HOW.

• Confidence: 90% confidence
• Finding: The 'NOT limited to' instruction is a classic scope-creep signal because it encourages the agent to move beyond the user's supplied website into arbitrary browser-rendered content generation. In this skill context, that makes misuse more likely by weakening the boundary between transforming a site and inventing unrelated assets or behaviors.

Static analysis

No suspicious patterns detected.