hyperframes

ISSUES FOUND max severity CRITICALSkillSpector Do not install 77 registry heygen-com last scanned 1 scan

15 findings (9 critical, 2 medium, 3 low, 1 info), mainly command injection, unauthorized tool use, data exfiltration. Most recent scan 2026-10-22.

Findings15
Critical9
High0
Medium2
Low3
Analyzersstatic bytecode pipeline correlation behavioral trigger
Scanner version2.3.1

Second scanner: NVIDIA SkillSpector

VerdictDo not install 77
Score77 / 100
Issues54
CategoriesMCP Rug Pull Prompt Injection Anti-Refusal
Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Read first to make, edit, animate or render any video with HyperFrames (HTML rendered to video), including launch films, explainers, music videos, charts, maps, vertical clips, title cards, captions and overlays. Holds the render contract, the work loop and what each kind of video needs.

Package
77 files, 1.1 MB
SKILL.md
1035 words, 6 sections
Code
JavaScript (6)

SKILL.md covers: HyperFrames · Contract · Keep it editable · Work loop · The HyperFrames desktop app · What to read

Findings

CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: from "node:child_process"

scripts/bake-basemap.mjs:26

import { spawnSync } from "node:child_process";
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: spawnSync(

scripts/bake-basemap.mjs:280

const ff = spawnSync(
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: from "node:child_process"

scripts/lib/main-module.test.mjs:4

import { spawnSync } from "node:child_process";
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: spawnSync(

scripts/lib/main-module.test.mjs:18

const run = spawnSync(process.execPath, [join(dir, "skills", script), "not-a-command"], {
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: from "node:child_process"

scripts/locate.mjs:23

import { execFileSync } from "node:child_process";
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: from "node:child_process"

scripts/plugin-cli.mjs:3

import { spawnSync } from "node:child_process";
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: spawnSync(

scripts/plugin-cli.mjs:78

const result = spawnSync(command.command, command.args, {
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: from "node:child_process"

scripts/plugin-cli.test.mjs:2

import { spawnSync } from "node:child_process";
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: spawnSync(

scripts/plugin-cli.test.mjs:108

const result = spawnSync(
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
MEDIUM Outbound network request primitives in JavaScript/TypeScript Data Exfiltrationstatic

Pattern detected: fetch(

scripts/bake-basemap.mjs:196

fetch("https://cdn.jsdelivr.net/npm/world-atlas@2.0.2/countries-110m.json").then(function(r){return r.json();}).then(function(w){
Remediation: Ensure network operations are necessary and document allowed destinations
MEDIUM Outbound network request primitives in JavaScript/TypeScript Data Exfiltrationstatic

Pattern detected: fetch(

scripts/locate.mjs:215

const res = await fetch(
Remediation: Ensure network operations are necessary and document allowed destinations
LOW Script contacts a destination the documentation never mentions Unauthorized Tool Usestatic

Script contacts or configures 'server.arcgisonline.com' but the skill documentation never visibly mentions it. Undocumented network destinations can indicate behaviour the manifest and description do not disclose.

scripts/bake-basemap.mjs:127

Remediation: Document the destination in SKILL.md (or the manifest description) if it is intended, or remove the undisclosed network access. Organizations can list internal hosts in llm_analysis.trusted_reference_domains.
LOW Script contacts a destination the documentation never mentions Unauthorized Tool Usestatic

Script contacts or configures 'a.basemaps.cartocdn.com' but the skill documentation never visibly mentions it. Undocumented network destinations can indicate behaviour the manifest and description do not disclose.

scripts/bake-basemap.mjs:128

Remediation: Document the destination in SKILL.md (or the manifest description) if it is intended, or remove the undisclosed network access. Organizations can list internal hosts in llm_analysis.trusted_reference_domains.
LOW Script contacts a destination the documentation never mentions Unauthorized Tool Usestatic

Script contacts or configures 'cdn.jsdelivr.net' but the skill documentation never visibly mentions it. Undocumented network destinations can indicate behaviour the manifest and description do not disclose.

scripts/bake-basemap.mjs:149

Remediation: Document the destination in SKILL.md (or the manifest description) if it is intended, or remove the undisclosed network access. Organizations can list internal hosts in llm_analysis.trusted_reference_domains.
INFO Skill does not specify a license Policy Violationstatic

Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

SKILL.md

Remediation: Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)

What is in the package

77 files, 1.1 MB. Show the list.
FileKindSize
SKILL.mddoc7.0 KB
references/captions.mddoc4.8 KB
references/film.mddoc6.9 KB
references/format.mddoc12 KB
references/look.mddoc5.9 KB
references/motion.mddoc11 KB
references/overlays.mddoc2.5 KB
references/plugin-installation.mddoc2.6 KB
references/review.mddoc5.2 KB
references/runtimes.mddoc3.0 KB
references/skill-lifecycle.mddoc3.5 KB
references/sound.mddoc3.5 KB
references/spec.mddoc5.9 KB
references/story.mddoc11 KB
references/storyboard-format.mddoc6.5 KB
references/storyboard.mddoc4.0 KB
scripts/bake-basemap.mjsscript18 KB
scripts/locate.mjsscript8.0 KB
scripts/plugin-cli.mjsscript2.8 KB
scripts/plugin-cli.test.mjsscript4.3 KB
references/types/3d.mddoc1.6 KB
references/types/character.mddoc1.6 KB
references/types/data.mddoc1.3 KB
references/types/explainer.mddoc3.0 KB
references/types/launch.mddoc2.8 KB
references/types/music.mddoc1.6 KB
references/types/vertical.mddoc1.6 KB
scripts/lib/main-module.mjsscript479 B
scripts/lib/main-module.test.mjsscript1.9 KB
assets/frame-presets/biennale-yellow/FRAME.mddoc17 KB
assets/frame-presets/biennale-yellow/caption-skin.htmldata7.9 KB
assets/frame-presets/biennale-yellow/frame-showcase.htmldata34 KB
assets/frame-presets/blockframe/FRAME.mddoc16 KB
assets/frame-presets/blockframe/caption-skin.htmldata8.1 KB
assets/frame-presets/blockframe/frame-showcase.htmldata38 KB
assets/frame-presets/blue-professional/FRAME.mddoc17 KB
assets/frame-presets/blue-professional/caption-skin.htmldata8.1 KB
assets/frame-presets/blue-professional/frame-showcase.htmldata38 KB
assets/frame-presets/bold-poster/FRAME.mddoc16 KB
assets/frame-presets/bold-poster/caption-skin.htmldata8.5 KB
assets/frame-presets/bold-poster/frame-showcase.htmldata32 KB
assets/frame-presets/broadside/FRAME.mddoc16 KB
assets/frame-presets/broadside/caption-skin.htmldata8.2 KB
assets/frame-presets/broadside/frame-showcase.htmldata33 KB
assets/frame-presets/capsule/FRAME.mddoc17 KB
assets/frame-presets/capsule/caption-skin.htmldata8.2 KB
assets/frame-presets/capsule/frame-showcase.htmldata42 KB
assets/frame-presets/cartesian/FRAME.mddoc17 KB
assets/frame-presets/cartesian/caption-skin.htmldata8.1 KB
assets/frame-presets/cartesian/frame-showcase.htmldata35 KB
assets/frame-presets/cobalt-grid/FRAME.mddoc17 KB
assets/frame-presets/cobalt-grid/caption-skin.htmldata8.6 KB
assets/frame-presets/cobalt-grid/frame-showcase.htmldata46 KB
assets/frame-presets/code-editorial/FRAME.mddoc20 KB
assets/frame-presets/code-editorial/caption-skin.htmldata8.1 KB
assets/frame-presets/code-editorial/frame-showcase.htmldata43 KB
assets/frame-presets/coral/FRAME.mddoc19 KB
assets/frame-presets/coral/caption-skin.htmldata8.1 KB
assets/frame-presets/coral/frame-showcase.htmldata36 KB
assets/frame-presets/creative-mode/FRAME.mddoc19 KB
assets/frame-presets/creative-mode/caption-skin.htmldata8.2 KB
assets/frame-presets/creative-mode/frame-showcase.htmldata38 KB
assets/frame-presets/daisy-days/FRAME.mddoc17 KB
assets/frame-presets/daisy-days/caption-skin.htmldata8.3 KB
assets/frame-presets/daisy-days/frame-showcase.htmldata41 KB
assets/frame-presets/editorial-forest/FRAME.mddoc17 KB
assets/frame-presets/editorial-forest/caption-skin.htmldata8.2 KB
assets/frame-presets/editorial-forest/frame-showcase.htmldata36 KB
assets/frame-presets/code-editorial/fonts/EBGaramond-400.woff2binary21 KB
assets/frame-presets/code-editorial/fonts/EBGaramond-700.woff2binary23 KB
assets/frame-presets/code-editorial/fonts/Inter-400.woff2binary23 KB
assets/frame-presets/code-editorial/fonts/Inter-700.woff2binary24 KB
assets/frame-presets/code-editorial/fonts/JetBrainsMono-400.woff2binary21 KB
assets/frame-presets/code-editorial/fonts/JetBrainsMono-700.woff2binary21 KB
assets/frame-presets/code-editorial/fonts/OFL-eb-garamond.txtdoc4.4 KB
assets/frame-presets/code-editorial/fonts/OFL-inter.txtdoc4.4 KB
assets/frame-presets/code-editorial/fonts/OFL-jetbrains-mono.txtdoc4.4 KB

External hosts referenced

fonts.googleapis.com cdn.jsdelivr.net fonts.gstatic.com github.com scripts.sil.org a.basemaps.cartocdn.com generativelanguage.googleapis.com server.arcgisonline.com

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Environment variables referenced

PROJECTION GEMINI_API_KEY GOOGLE_API_KEY OPENROUTER_API_KEY

Package contents recorded 2026-10-22 at commit 4371981b740d. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

What we did not check

Sources

Related skills