Security audit

Hyperframes

Security checks across malware telemetry and agentic risk

Overview

Hyperframes is a coherent video-authoring skill, but it asks agents to run a background project-wide web server and uses several third-party network resources that users should review first.

Install only if you are comfortable with this skill creating project files, loading animation/font assets from third-party services, and optionally uploading audio to transcription APIs. For the design picker, bind any local server to 127.0.0.1 and serve only the picker directory when possible, then stop the server promptly after use.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The reference documentation explicitly instructs users to load executable third-party code from a public CDN inside generated HTML compositions. Even in a video-authoring skill, this introduces a supply-chain and remote-code dependency path: the rendered project can execute whatever the CDN serves, which is outside the local asset boundary implied by the skill's purpose.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: Recommending MotionPathPlugin from a public CDN similarly adds remote code-fetch and execution capability that is not necessary for a local HTML video composition workflow. This expands the trust boundary to a third-party host and creates avoidable risk from compromise, substitution, outage, or unexpected version changes affecting generated content.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The template loads executable JavaScript from jsDelivr at runtime, which introduces a third-party supply-chain trust dependency into a local design workflow asset. If the CDN, package, or network path is compromised, arbitrary script can run in the user's browser with access to the page, generated content, and clipboard interactions.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The page dynamically constructs a Google Fonts URL from TYPEPAIRS data and injects it into the document, causing runtime requests to an external service. This creates both a privacy issue and a supply-chain dependency, and if font metadata is influenced upstream it expands the set of external resources the page may contact.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This file instructs the agent to write `.hyperframes/expanded-prompt.md` in the project directory, but the user-facing message only tells the user after the write has already occurred. That creates an unauthorized file-modification side effect: a prompt-processing step can alter the workspace without explicit prior consent, which is risky in agent environments where repository state and generated artifacts matter.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The guide instructs users to upload audio files to third-party transcription services but does not warn that the media content leaves the local environment and may contain sensitive voice, conversation, or copyrighted material. In a skill focused on media processing, this omission can lead users to transmit private data without informed consent or awareness of retention, logging, or policy implications.

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: The script hard-codes a filter requiring the "latin" subset, which excludes non-Latin scripts by default without any user-driven justification or fallback path. In a content-generation skill for typography and video production, this can systematically bias outputs against many languages and lead to inaccessible or unusable recommendations for multilingual or non-Latin content.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The file makes third-party network requests for script assets without informing the user that browser metadata and access patterns will be exposed to an external CDN. In a design-picker UI this is not strictly necessary to the core purpose and reduces transparency around data flows.

Missing User Warnings

Low

Confidence: 93% confidence
Finding: Dynamic Google Fonts loading sends user/browser requests to Google without any notice in the interface. Even if the data exposed is limited to standard web request metadata, undisclosed outbound requests are a privacy and trust concern for a local composition tool.

External Transmission

Medium

Category: Data Exfiltration
Content: ```bash # Generate with word timestamps, then import curl https://api.openai.com/v1/audio/transcriptions \ -H "Authorization: Bearer $OPENAI_API_KEY" \ -F file=@audio.mp3 -F model=whisper-1 \ -F response_format=verbose_json \
Confidence: 89% confidence
Finding: https://api.openai.com/

External Transmission

Medium

Category: Data Exfiltration
Content: **Groq Whisper API** (fast, free tier available): ```bash curl https://api.groq.com/openai/v1/audio/transcriptions \ -H "Authorization: Bearer $GROQ_API_KEY" \ -F file=@audio.mp3 -F model=whisper-large-v3 \ -F response_format=verbose_json \
Confidence: 89% confidence
Finding: https://api.groq.com/

VirusTotal

57/57 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/package-loader.mjs:229