changelog-video

SAFE max severity MEDIUMSkillSpector Caution 25 registry heygen-com last scanned 2 scans

Verdict safe, but 2 findings (1 medium, 1 info), mainly policy violation, obfuscation. Most recent scan 2026-10-22.

Findings2
Critical0
High0
Medium1
Low0
Analyzersstatic bytecode pipeline correlation behavioral trigger
Scanner version2.3.1

Second scanner: NVIDIA SkillSpector

VerdictCaution 25
Score25 / 100
Issues5
CategoriesMCP Rug Pull analysis-evasion
Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Turn a weekly changelog .md into a finished branded changelog video (square 1080, ~45-60s, Annie VO, animated brand background, mock-UI visualizations, lowkey captions). Use when the user provides a changelog/digest markdown and wants the weekly video, or says "changelog video". Self-contained — fonts, background, lexicon, and scripts ship in this skill.

Package
15 files, 521 KB
SKILL.md
1565 words, 12+ sections
Code
JavaScript (1)

SKILL.md covers: Changelog → Branded Video · The prime directive: visualize, don't list · Pipeline · 0 · Bootstrap the project from THIS skill's assets — non-negotiable · 1 · Parse + editorial cut · 2 · Visualization routing · 3 · Two-layer script (spoken vs display) · 4 · VO — Annie (HeyGen, pinned) · spoken-layer text only; words JSON = ground-truth timestamps of the SPOKEN text · Repo-native path: the changelog-video skill runs from the hyperframes repo root, · so it uses the tracked hyperframes-media TTS helper directly (no `npx hyperframes · skills` install step). If you've copied the skill into another repo, swap in

Findings

MEDIUM File extension does not match actual content type Obfuscationstatic

File 'bg-pattern.mp4' extension (.mp4, expected video) does not match its actual content type (Open Neural Network Exchange, archive).

assets/bg-pattern.mp4

Remediation: Rename the file to match its actual content type, or remove it if it appears malicious.
INFO Skill does not specify a license Policy Violationstatic

Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

SKILL.md

Remediation: Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)

What is in the package

FileKindSize
SKILL.mddoc13 KB
assets/bg-pattern.mp4binary133 B
assets/bgm.mp3binary132 B
examples/master-skeleton.htmldata8.0 KB
examples/script-tokens.jsonconfig1.2 KB
references/build-spec.mddoc5.9 KB
references/lexicon.jsonconfig1.6 KB
references/script-voice.mddoc4.8 KB
references/visualization-registry.mddoc7.2 KB
scripts/align-captions.mjsscript4.5 KB
assets/fonts/ABCSolarDisplay-Bold.woff2binary103 KB
assets/fonts/TT_Norms_Pro_Bold.woff2binary99 KB
assets/fonts/TT_Norms_Pro_Medium.woff2binary96 KB
assets/fonts/TT_Norms_Pro_Normal.woff2binary98 KB
assets/fonts/tt_norms_pro_mono_regular-webfont.woff2binary80 KB

External hosts referenced

cdn.jsdelivr.net

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Package contents recorded 2026-10-22 at commit 4371981b740d. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

What we did not check

Scan history

DateVerdictFindingsChangeAnalyzersRaw
SAFE 2 = static bytecode pipeline correlation behavioral trigger JSON
SAFE 2 first scan static bytecode pipeline correlation behavioral trigger JSON

Sources

Related skills