media-use

ISSUES FOUND max severity CRITICALSkillSpector Do not install 100 registry heygen-com last scanned 1 scan

116 findings (52 critical, 22 medium, 22 low, 20 info), mainly command injection, policy violation, data exfiltration. Most recent scan 2026-10-22.

Findings116
Critical52
High0
Medium22
Low22
Analyzersstatic bytecode pipeline correlation behavioral trigger
Scanner version2.3.1

Second scanner: NVIDIA SkillSpector

VerdictDo not install 100
Score100 / 100
Issues149
CategoriesMCP Rug Pull Privilege Escalation Data Exfiltration
Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Get or make any media for a HyperFrames video - music, sound effects, images, icons, logos, voiceover, avatar and generated video, transcripts, cutouts, colour grades and looks - with HeyGen or free local tools, and mix placed audio. Also for footage that looks dark, flat or dull, or should be stylized or hidden.

Package
116 files, 1.8 MB
SKILL.md
714 words, 5 sections
Code
JavaScript (65), Python (4)

SKILL.md covers: Media in HyperFrames · Two ways to get it · Looks on real footage · Offer once, never add silently · Where to look

Findings

CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: from "node:child_process"

audio/scripts/audio.test.mjs:4

import { spawnSync } from "node:child_process";
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: spawnSync(

audio/scripts/audio.test.mjs:141

return spawnSync(process.execPath, [join(HERE, "audio.mjs"), "--hyperframes", dir, ...args], {
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: from "node:child_process"

audio/scripts/carve.mjs:27

import { execFileSync } from "node:child_process";
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: from "node:child_process"

audio/scripts/carve.test.mjs:3

import { execFileSync } from "node:child_process";
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: from "node:child_process"

audio/scripts/gemini-pipeline.test.mjs:6

import { spawnSync } from "node:child_process";
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: spawnSync(

audio/scripts/gemini-pipeline.test.mjs:78

const result = spawnSync(
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: from "node:child_process"

audio/scripts/heygen-tts.test.mjs:3

import { spawnSync } from "node:child_process";
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: spawnSync(

audio/scripts/heygen-tts.test.mjs:17

const run = spawnSync(
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: from "node:child_process"

audio/scripts/lib/audio-meta.test.mjs:14

import { spawnSync } from "node:child_process";
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: spawnSync(

audio/scripts/lib/audio-meta.test.mjs:110

const result = spawnSync(
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: from "node:child_process"

audio/scripts/lib/bgm.mjs:14

import { spawn, spawnSync } from "node:child_process";
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: spawnSync(

audio/scripts/lib/bgm.mjs:35

return spawnSync(cmd, args, { stdio: "ignore" }).status === 0;
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: spawnSync(

audio/scripts/lib/bgm.mjs:45

return spawnSync(cmd, args, { stdio: "ignore" }).status === 0;
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Dangerous code execution functions that can execute arbitrary code Command Injectionstatic

Pattern detected: eval(

audio/scripts/lib/bgm.mjs:232

model.eval()
Remediation: Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: from "node:child_process"

audio/scripts/lib/gemini-auth.mjs:1

import { spawnSync } from "node:child_process";
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: from "node:child_process"

audio/scripts/lib/gemini-auth.test.mjs:1

import { spawnSync } from "node:child_process";
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: spawnSync(

audio/scripts/lib/gemini-auth.test.mjs:84

const result = spawnSync(cmd, args, { encoding: "utf8", timeout: 30_000 });
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: from "node:child_process"

audio/scripts/lib/python.mjs:18

import { spawnSync } from "node:child_process";
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: spawnSync(

audio/scripts/lib/python.mjs:26

const result = spawnSync(cmd, args, { encoding: "utf-8", timeout: 5000 });
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: from "node:child_process"

audio/scripts/lib/tts.cleanup.test.mjs:3

import { spawnSync } from "node:child_process";
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: from "node:child_process"

audio/scripts/lib/tts.cleanup.test.mjs:37

import childProcess from "node:child_process";
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: spawnSync(

audio/scripts/lib/tts.cleanup.test.mjs:129

const result = spawnSync(process.execPath, ["--input-type=module", "-e", exercise], {
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: from "node:child_process"

audio/scripts/lib/tts.mjs:17

import { spawn, spawnSync } from "node:child_process";
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: spawnSync(

audio/scripts/lib/tts.mjs:33

const r = spawnSync(cmd, args, {
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: spawnSync(

audio/scripts/lib/tts.mjs:111

const r = spawnSync("ffmpeg", ["-i", absPath], { encoding: "utf8" });
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: spawnSync(

audio/scripts/lib/tts.mjs:116

const r = spawnSync(
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: spawnSync(

audio/scripts/lib/tts.mjs:223

const ff = spawnSync(
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: from "node:child_process"

audio/scripts/wait-bgm.test.mjs:3

import { spawnSync } from "node:child_process";
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: spawnSync(

audio/scripts/wait-bgm.test.mjs:87

const run = spawnSync(process.execPath, [script, ...args, "--timeout-ms", "1000"], {
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: from "node:child_process"

scripts/compatibility.test.mjs:4

import { execFileSync } from "node:child_process";
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: from "node:child_process"

scripts/dither.mjs:3

import { execFileSync, spawn } from "node:child_process";
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: from "node:child_process"

scripts/dither.test.mjs:2

import { execFileSync, spawnSync } from "node:child_process";
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: spawnSync(

scripts/dither.test.mjs:11

spawnSync("ffmpeg", ["-version"], { stdio: "ignore" }).status === 0 &&
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: spawnSync(

scripts/dither.test.mjs:12

spawnSync("ffprobe", ["-version"], { stdio: "ignore" }).status === 0;
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: spawnSync(

scripts/dither.test.mjs:24

return spawnSync(process.execPath, [SCRIPT, ...args, "--json"], { encoding: "utf8" });
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: from "node:child_process"

scripts/eval.mjs:18

import { execFileSync } from "node:child_process";
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Dangerous code execution functions that can execute arbitrary code Command Injectionstatic

Pattern detected: exec (

scripts/lib/npx-sync.mjs:20

// execFileSync/spawnSync cannot exec (spawnSync npx ENOENT) —
Remediation: Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: from "node:child_process"

scripts/resolve-plugin.test.mjs:2

import { spawnSync } from "node:child_process";
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: spawnSync(

scripts/resolve-plugin.test.mjs:24

const result = spawnSync(process.execPath, [join(dir, "resolve.mjs"), "--intent", "a & b"], {
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: spawnSync(

scripts/resolve-plugin.test.mjs:52

const result = spawnSync(process.execPath, [join(scripts, "resolve.mjs")], {
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: from "node:child_process"

scripts/resolve.mjs:2

import { spawnSync } from "node:child_process";
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: spawnSync(

scripts/resolve.mjs:16

const result = spawnSync(invocation.cmd, invocation.args, invocation.opts);
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: spawnSync(

scripts/resolve.mjs:23

? spawnSync(process.execPath, [dist, "media-use", "resolve", ...process.argv.slice(2)], {
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: spawnSync(

scripts/resolve.mjs:26

: spawnSync(
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: from "node:child_process"

scripts/transcribe.mjs:3

import { execFileSync } from "node:child_process";
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: from "node:child_process"

scripts/transcribe.test.mjs:2

import { execFileSync, spawnSync } from "node:child_process";
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: spawnSync(

scripts/transcribe.test.mjs:91

const res = spawnSync(
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: from "node:child_process"

scripts/transcript-cut.mjs:3

import { execFileSync } from "node:child_process";
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: from "node:child_process"

scripts/transcript-cut.test.mjs:2

import { execFileSync, spawnSync } from "node:child_process";
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: spawnSync(

scripts/transcript-cut.test.mjs:11

spawnSync("ffmpeg", ["-version"], { stdio: "ignore" }).status === 0 &&
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: spawnSync(

scripts/transcript-cut.test.mjs:12

spawnSync("ffprobe", ["-version"], { stdio: "ignore" }).status === 0;
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: spawnSync(

scripts/transcript-cut.test.mjs:28

return spawnSync(process.execPath, [SCRIPT, ...args], { encoding: "utf8" });
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
MEDIUM Moderate analyzability score Policy Violationanalyzability

Only 80% of skill content could be analyzed. 19 of 116 files are opaque to the scanner. Some content could not be verified as safe.

Remediation: Review opaque files and replace with inspectable formats where possible.
MEDIUM Unanalyzable binary file Policy Violationanalyzability

Binary file 'audio/assets/sfx/chime.mp3' cannot be inspected by the scanner. Reason: Binary file (.mp3) - cannot inspect content. Binary files resist static analysis and may contain hidden functionality.

audio/assets/sfx/chime.mp3

Remediation: Replace binary files with source code, or submit the binary to VirusTotal for independent verification (--use-virustotal).
MEDIUM Unanalyzable binary file Policy Violationanalyzability

Binary file 'audio/assets/sfx/click-soft.mp3' cannot be inspected by the scanner. Reason: Binary file (.mp3) - cannot inspect content. Binary files resist static analysis and may contain hidden functionality.

audio/assets/sfx/click-soft.mp3

Remediation: Replace binary files with source code, or submit the binary to VirusTotal for independent verification (--use-virustotal).
MEDIUM Unanalyzable binary file Policy Violationanalyzability

Binary file 'audio/assets/sfx/click.mp3' cannot be inspected by the scanner. Reason: Binary file (.mp3) - cannot inspect content. Binary files resist static analysis and may contain hidden functionality.

audio/assets/sfx/click.mp3

Remediation: Replace binary files with source code, or submit the binary to VirusTotal for independent verification (--use-virustotal).
MEDIUM Unanalyzable binary file Policy Violationanalyzability

Binary file 'audio/assets/sfx/error.mp3' cannot be inspected by the scanner. Reason: Binary file (.mp3) - cannot inspect content. Binary files resist static analysis and may contain hidden functionality.

audio/assets/sfx/error.mp3

Remediation: Replace binary files with source code, or submit the binary to VirusTotal for independent verification (--use-virustotal).
MEDIUM Unanalyzable binary file Policy Violationanalyzability

Binary file 'audio/assets/sfx/glitch-1.mp3' cannot be inspected by the scanner. Reason: Binary file (.mp3) - cannot inspect content. Binary files resist static analysis and may contain hidden functionality.

audio/assets/sfx/glitch-1.mp3

Remediation: Replace binary files with source code, or submit the binary to VirusTotal for independent verification (--use-virustotal).
MEDIUM Unanalyzable binary file Policy Violationanalyzability

Binary file 'audio/assets/sfx/glitch-2.mp3' cannot be inspected by the scanner. Reason: Binary file (.mp3) - cannot inspect content. Binary files resist static analysis and may contain hidden functionality.

audio/assets/sfx/glitch-2.mp3

Remediation: Replace binary files with source code, or submit the binary to VirusTotal for independent verification (--use-virustotal).
MEDIUM Unanalyzable binary file Policy Violationanalyzability

Binary file 'audio/assets/sfx/glitch-3.mp3' cannot be inspected by the scanner. Reason: Binary file (.mp3) - cannot inspect content. Binary files resist static analysis and may contain hidden functionality.

audio/assets/sfx/glitch-3.mp3

Remediation: Replace binary files with source code, or submit the binary to VirusTotal for independent verification (--use-virustotal).
MEDIUM Unanalyzable binary file Policy Violationanalyzability

Binary file 'audio/assets/sfx/impact-bass-1.mp3' cannot be inspected by the scanner. Reason: Binary file (.mp3) - cannot inspect content. Binary files resist static analysis and may contain hidden functionality.

audio/assets/sfx/impact-bass-1.mp3

Remediation: Replace binary files with source code, or submit the binary to VirusTotal for independent verification (--use-virustotal).
MEDIUM Unanalyzable binary file Policy Violationanalyzability

Binary file 'audio/assets/sfx/impact-bass-2.mp3' cannot be inspected by the scanner. Reason: Binary file (.mp3) - cannot inspect content. Binary files resist static analysis and may contain hidden functionality.

audio/assets/sfx/impact-bass-2.mp3

Remediation: Replace binary files with source code, or submit the binary to VirusTotal for independent verification (--use-virustotal).
MEDIUM Unanalyzable binary file Policy Violationanalyzability

Binary file 'audio/assets/sfx/key-press.mp3' cannot be inspected by the scanner. Reason: Binary file (.mp3) - cannot inspect content. Binary files resist static analysis and may contain hidden functionality.

audio/assets/sfx/key-press.mp3

Remediation: Replace binary files with source code, or submit the binary to VirusTotal for independent verification (--use-virustotal).
MEDIUM Unanalyzable binary file Policy Violationanalyzability

Binary file 'audio/assets/sfx/notification.mp3' cannot be inspected by the scanner. Reason: Binary file (.mp3) - cannot inspect content. Binary files resist static analysis and may contain hidden functionality.

audio/assets/sfx/notification.mp3

Remediation: Replace binary files with source code, or submit the binary to VirusTotal for independent verification (--use-virustotal).
MEDIUM Unanalyzable binary file Policy Violationanalyzability

Binary file 'audio/assets/sfx/ping.mp3' cannot be inspected by the scanner. Reason: Binary file (.mp3) - cannot inspect content. Binary files resist static analysis and may contain hidden functionality.

audio/assets/sfx/ping.mp3

Remediation: Replace binary files with source code, or submit the binary to VirusTotal for independent verification (--use-virustotal).
MEDIUM Unanalyzable binary file Policy Violationanalyzability

Binary file 'audio/assets/sfx/pop.mp3' cannot be inspected by the scanner. Reason: Binary file (.mp3) - cannot inspect content. Binary files resist static analysis and may contain hidden functionality.

audio/assets/sfx/pop.mp3

Remediation: Replace binary files with source code, or submit the binary to VirusTotal for independent verification (--use-virustotal).
MEDIUM Unanalyzable binary file Policy Violationanalyzability

Binary file 'audio/assets/sfx/riser.mp3' cannot be inspected by the scanner. Reason: Binary file (.mp3) - cannot inspect content. Binary files resist static analysis and may contain hidden functionality.

audio/assets/sfx/riser.mp3

Remediation: Replace binary files with source code, or submit the binary to VirusTotal for independent verification (--use-virustotal).
MEDIUM Unanalyzable binary file Policy Violationanalyzability

Binary file 'audio/assets/sfx/sparkle.mp3' cannot be inspected by the scanner. Reason: Binary file (.mp3) - cannot inspect content. Binary files resist static analysis and may contain hidden functionality.

audio/assets/sfx/sparkle.mp3

Remediation: Replace binary files with source code, or submit the binary to VirusTotal for independent verification (--use-virustotal).
MEDIUM Unanalyzable binary file Policy Violationanalyzability

Binary file 'audio/assets/sfx/typing.mp3' cannot be inspected by the scanner. Reason: Binary file (.mp3) - cannot inspect content. Binary files resist static analysis and may contain hidden functionality.

audio/assets/sfx/typing.mp3

Remediation: Replace binary files with source code, or submit the binary to VirusTotal for independent verification (--use-virustotal).
MEDIUM Unanalyzable binary file Policy Violationanalyzability

Binary file 'audio/assets/sfx/whoosh-cinematic.mp3' cannot be inspected by the scanner. Reason: Binary file (.mp3) - cannot inspect content. Binary files resist static analysis and may contain hidden functionality.

audio/assets/sfx/whoosh-cinematic.mp3

Remediation: Replace binary files with source code, or submit the binary to VirusTotal for independent verification (--use-virustotal).
MEDIUM Unanalyzable binary file Policy Violationanalyzability

Binary file 'audio/assets/sfx/whoosh-short.mp3' cannot be inspected by the scanner. Reason: Binary file (.mp3) - cannot inspect content. Binary files resist static analysis and may contain hidden functionality.

audio/assets/sfx/whoosh-short.mp3

Remediation: Replace binary files with source code, or submit the binary to VirusTotal for independent verification (--use-virustotal).
MEDIUM Unanalyzable binary file Policy Violationanalyzability

Binary file 'audio/assets/sfx/whoosh.mp3' cannot be inspected by the scanner. Reason: Binary file (.mp3) - cannot inspect content. Binary files resist static analysis and may contain hidden functionality.

audio/assets/sfx/whoosh.mp3

Remediation: Replace binary files with source code, or submit the binary to VirusTotal for independent verification (--use-virustotal).
MEDIUM Outbound network request primitives in JavaScript/TypeScript Data Exfiltrationstatic

Pattern detected: fetch(

audio/scripts/lib/heygen.mjs:190

const res = await fetch(`${heygenBase()}${path}`, opts);
Remediation: Ensure network operations are necessary and document allowed destinations
MEDIUM Outbound network request primitives in JavaScript/TypeScript Data Exfiltrationstatic

Pattern detected: fetch(

scripts/lib/telemetry.mjs:163

await fetch(`${posthogHost()}/batch/`, {
Remediation: Ensure network operations are necessary and document allowed destinations
LOW Skill package contains many files Policy Violationstatic

Skill package contains 116 files. Large file counts increase attack surface and may indicate bundled dependencies or unnecessary content.

.

Remediation: Review file inventory and remove unnecessary files.
LOW Script contacts a destination the documentation never mentions Unauthorized Tool Usestatic

Script contacts or configures 'generativelanguage.googleapis.com' but the skill documentation never visibly mentions it. Undocumented network destinations can indicate behaviour the manifest and description do not disclose.

audio/scripts/gemini-pipeline.test.mjs:38

Remediation: Document the destination in SKILL.md (or the manifest description) if it is intended, or remove the undisclosed network access. Organizations can list internal hosts in llm_analysis.trusted_reference_domains.
LOW Node.js filesystem access candidate for sensitive-flow correlation Data Exfiltrationstatic

Pattern detected: fs.writeFileSync(

audio/scripts/gemini-pipeline.test.mjs:60

fs.writeFileSync(path.join(args[args.indexOf('--dir')+1], 'transcript.json'), JSON.stringify([
Remediation: Review filesystem operations and correlate sensitive sources with outbound sinks
LOW Script contacts a destination the documentation never mentions Unauthorized Tool Usestatic

Script contacts or configures 'api.heygen.com' but the skill documentation never visibly mentions it. Undocumented network destinations can indicate behaviour the manifest and description do not disclose.

audio/scripts/heygen-voice.test.mjs:35

Remediation: Document the destination in SKILL.md (or the manifest description) if it is intended, or remove the undisclosed network access. Organizations can list internal hosts in llm_analysis.trusted_reference_domains.
LOW Script contacts a destination the documentation never mentions Unauthorized Tool Usestatic

Script contacts or configures 'oauth2.googleapis.com' but the skill documentation never visibly mentions it. Undocumented network destinations can indicate behaviour the manifest and description do not disclose.

audio/scripts/lib/gemini-auth.py:30

Remediation: Document the destination in SKILL.md (or the manifest description) if it is intended, or remove the undisclosed network access. Organizations can list internal hosts in llm_analysis.trusted_reference_domains.
LOW Script contacts a destination the documentation never mentions Unauthorized Tool Usestatic

Script contacts or configures 'www.googleapis.com' but the skill documentation never visibly mentions it. Undocumented network destinations can indicate behaviour the manifest and description do not disclose.

audio/scripts/lib/gemini-auth.py:34

Remediation: Document the destination in SKILL.md (or the manifest description) if it is intended, or remove the undisclosed network access. Organizations can list internal hosts in llm_analysis.trusted_reference_domains.
LOW Script contacts a destination the documentation never mentions Unauthorized Tool Usestatic

Script contacts or configures 'api-canary.heygen.com' but the skill documentation never visibly mentions it. Undocumented network destinations can indicate behaviour the manifest and description do not disclose.

audio/scripts/lib/heygen.test.mjs:222

Remediation: Document the destination in SKILL.md (or the manifest description) if it is intended, or remove the undisclosed network access. Organizations can list internal hosts in llm_analysis.trusted_reference_domains.
LOW Script contacts a destination the documentation never mentions Unauthorized Tool Usestatic

Script contacts or configures 'freesound.org' but the skill documentation never visibly mentions it. Undocumented network destinations can indicate behaviour the manifest and description do not disclose.

audio/scripts/lib/sfx.test.mjs:142

Remediation: Document the destination in SKILL.md (or the manifest description) if it is intended, or remove the undisclosed network access. Organizations can list internal hosts in llm_analysis.trusted_reference_domains.
LOW Node.js filesystem access candidate for sensitive-flow correlation Data Exfiltrationstatic

Pattern detected: fs.readFileSync(

audio/scripts/lib/tts.cleanup.test.mjs:19

const text = fs.readFileSync(input, "utf8");
Remediation: Review filesystem operations and correlate sensitive sources with outbound sinks
LOW Node.js filesystem access candidate for sensitive-flow correlation Data Exfiltrationstatic

Pattern detected: fs.writeFileSync(

audio/scripts/lib/tts.cleanup.test.mjs:20

fs.writeFileSync(output + ".started", input);
Remediation: Review filesystem operations and correlate sensitive sources with outbound sinks
LOW Node.js filesystem access candidate for sensitive-flow correlation Data Exfiltrationstatic

Pattern detected: fs.readFileSync(

audio/scripts/lib/tts.cleanup.test.mjs:26

const consumed = fs.readFileSync(input, "utf8");
Remediation: Review filesystem operations and correlate sensitive sources with outbound sinks
LOW Node.js filesystem access candidate for sensitive-flow correlation Data Exfiltrationstatic

Pattern detected: fs.writeFileSync(

audio/scripts/lib/tts.cleanup.test.mjs:27

fs.writeFileSync(output + ".json", JSON.stringify({ input, text, consumed, args }));
Remediation: Review filesystem operations and correlate sensitive sources with outbound sinks
LOW Node.js filesystem access candidate for sensitive-flow correlation Data Exfiltrationstatic

Pattern detected: fs.writeFileSync(

audio/scripts/lib/tts.cleanup.test.mjs:29

if (process.env.CASE_MODE !== "no-output") fs.writeFileSync(output, consumed);
Remediation: Review filesystem operations and correlate sensitive sources with outbound sinks
LOW Node.js filesystem access candidate for sensitive-flow correlation Data Exfiltrationstatic

Pattern detected: fs.writeFileSync(

audio/scripts/lib/tts.cleanup.test.mjs:44

fs.writeFileSync(join(preexisting, "marker"), "keep");
Remediation: Review filesystem operations and correlate sensitive sources with outbound sinks
LOW Node.js filesystem access candidate for sensitive-flow correlation Data Exfiltrationstatic

Pattern detected: fs.readFileSync(

audio/scripts/lib/tts.cleanup.test.mjs:85

const slowInput = fs.readFileSync(slowWav + ".started", "utf8");
Remediation: Review filesystem operations and correlate sensitive sources with outbound sinks
LOW Node.js filesystem access candidate for sensitive-flow correlation Data Exfiltrationstatic

Pattern detected: fs.readFileSync(

audio/scripts/lib/tts.cleanup.test.mjs:88

assert.equal(fs.readFileSync(slowInput, "utf8"), "slow");
Remediation: Review filesystem operations and correlate sensitive sources with outbound sinks
LOW Node.js filesystem access candidate for sensitive-flow correlation Data Exfiltrationstatic

Pattern detected: fs.writeFileSync(

audio/scripts/lib/tts.cleanup.test.mjs:90

fs.writeFileSync(process.env.RELEASE_FILE, "release");
Remediation: Review filesystem operations and correlate sensitive sources with outbound sinks
LOW Node.js filesystem access candidate for sensitive-flow correlation Data Exfiltrationstatic

Pattern detected: fs.readFileSync(

audio/scripts/lib/tts.cleanup.test.mjs:93

assert.equal(fs.readFileSync(slowWav, "utf8"), "slow");
Remediation: Review filesystem operations and correlate sensitive sources with outbound sinks
LOW Node.js filesystem access candidate for sensitive-flow correlation Data Exfiltrationstatic

Pattern detected: fs.readFileSync(

audio/scripts/lib/tts.cleanup.test.mjs:104

assert.equal(fs.readFileSync(wavAbs, "utf8"), "synthetic café");
Remediation: Review filesystem operations and correlate sensitive sources with outbound sinks
LOW Node.js filesystem access candidate for sensitive-flow correlation Data Exfiltrationstatic

Pattern detected: fs.readFileSync(

audio/scripts/lib/tts.cleanup.test.mjs:107

const log = JSON.parse(fs.readFileSync(wavAbs + ".json", "utf8"));
Remediation: Review filesystem operations and correlate sensitive sources with outbound sinks
LOW Node.js filesystem access candidate for sensitive-flow correlation Data Exfiltrationstatic

Pattern detected: fs.readFileSync(

audio/scripts/lib/tts.cleanup.test.mjs:115

assert.equal(fs.readFileSync(join(preexisting, "marker"), "utf8"), "keep");
Remediation: Review filesystem operations and correlate sensitive sources with outbound sinks
LOW Script contacts a destination the documentation never mentions Unauthorized Tool Usestatic

Script contacts or configures 'us.i.posthog.com' but the skill documentation never visibly mentions it. Undocumented network destinations can indicate behaviour the manifest and description do not disclose.

scripts/lib/telemetry.mjs:13

Remediation: Document the destination in SKILL.md (or the manifest description) if it is intended, or remove the undisclosed network access. Organizations can list internal hosts in llm_analysis.trusted_reference_domains.
INFO Skill does not specify a license Policy Violationstatic

Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

SKILL.md

Remediation: Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)
INFO Binary file detected in skill package Policy Violationstatic

Binary file found: audio/assets/sfx/chime.mp3. Binary files cannot be inspected by static analysis. Consider using Python or Bash scripts for transparency.

audio/assets/sfx/chime.mp3

Remediation: Review binary file necessity. Replace with auditable scripts if possible.
INFO Binary file detected in skill package Policy Violationstatic

Binary file found: audio/assets/sfx/click-soft.mp3. Binary files cannot be inspected by static analysis. Consider using Python or Bash scripts for transparency.

audio/assets/sfx/click-soft.mp3

Remediation: Review binary file necessity. Replace with auditable scripts if possible.
INFO Binary file detected in skill package Policy Violationstatic

Binary file found: audio/assets/sfx/click.mp3. Binary files cannot be inspected by static analysis. Consider using Python or Bash scripts for transparency.

audio/assets/sfx/click.mp3

Remediation: Review binary file necessity. Replace with auditable scripts if possible.
INFO Binary file detected in skill package Policy Violationstatic

Binary file found: audio/assets/sfx/error.mp3. Binary files cannot be inspected by static analysis. Consider using Python or Bash scripts for transparency.

audio/assets/sfx/error.mp3

Remediation: Review binary file necessity. Replace with auditable scripts if possible.
INFO Binary file detected in skill package Policy Violationstatic

Binary file found: audio/assets/sfx/glitch-1.mp3. Binary files cannot be inspected by static analysis. Consider using Python or Bash scripts for transparency.

audio/assets/sfx/glitch-1.mp3

Remediation: Review binary file necessity. Replace with auditable scripts if possible.
INFO Binary file detected in skill package Policy Violationstatic

Binary file found: audio/assets/sfx/glitch-2.mp3. Binary files cannot be inspected by static analysis. Consider using Python or Bash scripts for transparency.

audio/assets/sfx/glitch-2.mp3

Remediation: Review binary file necessity. Replace with auditable scripts if possible.
INFO Binary file detected in skill package Policy Violationstatic

Binary file found: audio/assets/sfx/glitch-3.mp3. Binary files cannot be inspected by static analysis. Consider using Python or Bash scripts for transparency.

audio/assets/sfx/glitch-3.mp3

Remediation: Review binary file necessity. Replace with auditable scripts if possible.
INFO Binary file detected in skill package Policy Violationstatic

Binary file found: audio/assets/sfx/impact-bass-1.mp3. Binary files cannot be inspected by static analysis. Consider using Python or Bash scripts for transparency.

audio/assets/sfx/impact-bass-1.mp3

Remediation: Review binary file necessity. Replace with auditable scripts if possible.
INFO Binary file detected in skill package Policy Violationstatic

Binary file found: audio/assets/sfx/impact-bass-2.mp3. Binary files cannot be inspected by static analysis. Consider using Python or Bash scripts for transparency.

audio/assets/sfx/impact-bass-2.mp3

Remediation: Review binary file necessity. Replace with auditable scripts if possible.
INFO Binary file detected in skill package Policy Violationstatic

Binary file found: audio/assets/sfx/key-press.mp3. Binary files cannot be inspected by static analysis. Consider using Python or Bash scripts for transparency.

audio/assets/sfx/key-press.mp3

Remediation: Review binary file necessity. Replace with auditable scripts if possible.
INFO Binary file detected in skill package Policy Violationstatic

Binary file found: audio/assets/sfx/notification.mp3. Binary files cannot be inspected by static analysis. Consider using Python or Bash scripts for transparency.

audio/assets/sfx/notification.mp3

Remediation: Review binary file necessity. Replace with auditable scripts if possible.
INFO Binary file detected in skill package Policy Violationstatic

Binary file found: audio/assets/sfx/ping.mp3. Binary files cannot be inspected by static analysis. Consider using Python or Bash scripts for transparency.

audio/assets/sfx/ping.mp3

Remediation: Review binary file necessity. Replace with auditable scripts if possible.
INFO Binary file detected in skill package Policy Violationstatic

Binary file found: audio/assets/sfx/pop.mp3. Binary files cannot be inspected by static analysis. Consider using Python or Bash scripts for transparency.

audio/assets/sfx/pop.mp3

Remediation: Review binary file necessity. Replace with auditable scripts if possible.
INFO Binary file detected in skill package Policy Violationstatic

Binary file found: audio/assets/sfx/riser.mp3. Binary files cannot be inspected by static analysis. Consider using Python or Bash scripts for transparency.

audio/assets/sfx/riser.mp3

Remediation: Review binary file necessity. Replace with auditable scripts if possible.
INFO Binary file detected in skill package Policy Violationstatic

Binary file found: audio/assets/sfx/sparkle.mp3. Binary files cannot be inspected by static analysis. Consider using Python or Bash scripts for transparency.

audio/assets/sfx/sparkle.mp3

Remediation: Review binary file necessity. Replace with auditable scripts if possible.
INFO Binary file detected in skill package Policy Violationstatic

Binary file found: audio/assets/sfx/typing.mp3. Binary files cannot be inspected by static analysis. Consider using Python or Bash scripts for transparency.

audio/assets/sfx/typing.mp3

Remediation: Review binary file necessity. Replace with auditable scripts if possible.
INFO Binary file detected in skill package Policy Violationstatic

Binary file found: audio/assets/sfx/whoosh-cinematic.mp3. Binary files cannot be inspected by static analysis. Consider using Python or Bash scripts for transparency.

audio/assets/sfx/whoosh-cinematic.mp3

Remediation: Review binary file necessity. Replace with auditable scripts if possible.
INFO Binary file detected in skill package Policy Violationstatic

Binary file found: audio/assets/sfx/whoosh-short.mp3. Binary files cannot be inspected by static analysis. Consider using Python or Bash scripts for transparency.

audio/assets/sfx/whoosh-short.mp3

Remediation: Review binary file necessity. Replace with auditable scripts if possible.
INFO Binary file detected in skill package Policy Violationstatic

Binary file found: audio/assets/sfx/whoosh.mp3. Binary files cannot be inspected by static analysis. Consider using Python or Bash scripts for transparency.

audio/assets/sfx/whoosh.mp3

Remediation: Review binary file necessity. Replace with auditable scripts if possible.

What is in the package

116 files, 1.8 MB. Show the list.
FileKindSize
.gitignoreother17 B
SKILL.mddoc5.0 KB
luts/README.mddoc1.1 KB
luts/index.jsonconfig2.0 KB
references/audio.mddoc2.2 KB
references/grading.mddoc6.8 KB
references/local.mddoc2.4 KB
references/media-treatment-recipes.mddoc35 KB
references/media-treatments.mddoc14 KB
references/memory.mddoc3.2 KB
references/meta.mddoc6.3 KB
references/mixing.mddoc4.3 KB
references/operations.mddoc15 KB
references/resolve.mddoc9.4 KB
references/setup-providers.mddoc8.4 KB
references/telemetry-dashboard.mddoc4.1 KB
scripts/audio-duck.mjsscript4.0 KB
scripts/compatibility.test.mjsscript1.6 KB
scripts/dither.mjsscript9.7 KB
scripts/dither.test.mjsscript4.6 KB
scripts/eval.mjsscript15 KB
scripts/prefs.mjsscript2.3 KB
scripts/recipe.mjsscript3.8 KB
scripts/resolve-plugin.test.mjsscript2.5 KB
scripts/resolve.mjsscript1.3 KB
scripts/transcribe.mjsscript7.3 KB
scripts/transcribe.test.mjsscript4.0 KB
scripts/transcript-cut.mjsscript10 KB
scripts/transcript-cut.test.mjsscript9.6 KB
audio/references/bgm.mddoc7.9 KB
audio/references/remove-background.mddoc8.3 KB
audio/references/requirements.mddoc4.2 KB
audio/references/sfx.mddoc4.0 KB
audio/references/transcribe.mddoc2.7 KB
audio/references/tts-to-captions.mddoc1.7 KB
audio/references/tts.mddoc13 KB
audio/scripts/audio.mjsscript13 KB
audio/scripts/audio.test.mjsscript5.9 KB
audio/scripts/carve.mjsscript23 KB
audio/scripts/carve.test.mjsscript12 KB
audio/scripts/extract-audio-data.pyscript7.0 KB
audio/scripts/gemini-pipeline.test.mjsscript4.8 KB
audio/scripts/heygen-tts.mjsscript4.3 KB
audio/scripts/heygen-tts.test.mjsscript1.4 KB
audio/scripts/heygen-voice.mjsscript3.8 KB
audio/scripts/heygen-voice.test.mjsscript8.3 KB
audio/scripts/lyria-recipe.pyscript4.9 KB
audio/scripts/wait-bgm.mjsscript5.7 KB
audio/scripts/wait-bgm.test.mjsscript3.3 KB
scripts/lib/config-lock.mjsscript1.5 KB
scripts/lib/cutlist.mjsscript6.2 KB
scripts/lib/duck.mjsscript3.3 KB
scripts/lib/error-diffusion.mjsscript6.5 KB
scripts/lib/index-gen.mjsscript1.9 KB
scripts/lib/manifest.mjsscript9.2 KB
scripts/lib/media-fetch.mjsscript2.8 KB
scripts/lib/media-home.mjsscript730 B
scripts/lib/npx-sync.mjsscript2.3 KB
scripts/lib/parakeet-words.mjsscript1.1 KB
scripts/lib/prefs-store.mjsscript6.5 KB
scripts/lib/recipe-store.mjsscript13 KB
scripts/lib/telemetry.mjsscript7.2 KB
scripts/lib/telemetry.test.mjsscript2.2 KB
scripts/lib/transcriptCutFade.mjsscript911 B
scripts/lib/words.mjsscript728 B
audio/assets/sfx/CREDITS.mddoc1.2 KB
audio/assets/sfx/chime.mp3binary27 KB
audio/assets/sfx/click-soft.mp3binary11 KB
audio/assets/sfx/click.mp3binary11 KB
audio/assets/sfx/error.mp3binary51 KB
audio/assets/sfx/glitch-1.mp3binary82 KB
audio/assets/sfx/glitch-2.mp3binary110 KB
audio/assets/sfx/glitch-3.mp3binary97 KB
audio/assets/sfx/impact-bass-1.mp3binary66 KB
audio/assets/sfx/impact-bass-2.mp3binary81 KB
audio/assets/sfx/key-press.mp3binary3.8 KB
audio/assets/sfx/manifest.jsonconfig3.6 KB
audio/assets/sfx/notification.mp3binary77 KB
audio/assets/sfx/ping.mp3binary26 KB
audio/assets/sfx/pop.mp3binary22 KB
audio/assets/sfx/riser.mp3binary314 KB
audio/assets/sfx/sparkle.mp3binary56 KB
audio/assets/sfx/typing.mp3binary26 KB
audio/assets/sfx/whoosh-cinematic.mp3binary173 KB
audio/assets/sfx/whoosh-short.mp3binary18 KB
audio/assets/sfx/whoosh.mp3binary18 KB
audio/references/captions/authoring.mddoc9.2 KB
audio/references/captions/motion.mddoc5.4 KB
audio/references/captions/transcript-handling.mddoc5.3 KB
audio/scripts/lib/audio-meta.mjsscript1.1 KB
audio/scripts/lib/audio-meta.test.mjsscript4.5 KB
audio/scripts/lib/bgm-volume.mjsscript236 B
audio/scripts/lib/bgm.mjsscript11 KB
audio/scripts/lib/bgm.test.mjsscript2.6 KB
audio/scripts/lib/concurrency.mjsscript527 B
audio/scripts/lib/concurrency.test.mjsscript1.6 KB
audio/scripts/lib/gemini-auth.mjsscript1.6 KB
audio/scripts/lib/gemini-auth.pyscript1.9 KB
audio/scripts/lib/gemini-auth.test.mjsscript3.0 KB
audio/scripts/lib/gemini-auth_test.pyscript4.3 KB
audio/scripts/lib/gemini-tts.mjsscript4.6 KB
audio/scripts/lib/gemini-tts.test.mjsscript8.8 KB
audio/scripts/lib/heygen.mjsscript11 KB
audio/scripts/lib/heygen.test.mjsscript10.0 KB
audio/scripts/lib/main-module.mjsscript479 B
audio/scripts/lib/media-record.mjsscript4.1 KB
audio/scripts/lib/media-record.test.mjsscript7.7 KB
audio/scripts/lib/openverse.mjsscript4.9 KB
audio/scripts/lib/python.mjsscript3.2 KB
audio/scripts/lib/python.test.mjsscript5.2 KB
audio/scripts/lib/sfx.mjsscript7.2 KB
audio/scripts/lib/sfx.test.mjsscript12 KB
audio/scripts/lib/tts.cleanup.test.mjsscript6.6 KB
audio/scripts/lib/tts.mjsscript17 KB
audio/scripts/lib/tts.spawn.test.mjsscript5.1 KB
audio/scripts/lib/tts.test.mjsscript8.1 KB

External hosts referenced

api.heygen.com api.openverse.org developers.heygen.com static.heygen.ai api-canary.heygen.com generativelanguage.googleapis.com pixabay.com audio.example oauth2.googleapis.com www.googleapis.com ai.google.dev api.elevenlabs.io api.groq.com api.openai.com freesound.org github.com hyperframes.heygen.com openverse.org us.i.posthog.com

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Environment variables referenced

HEYGEN_API_KEY GEMINI_API_KEY HEYGEN_API_BASE GOOGLE_API_KEY HEYGEN_CONFIG_DIR ELEVENLABS_API_KEY HEYGEN_ACCESS_TOKEN HYPERFRAMES_API_KEY GCS_CREDS GOOGLE_APPLICATION_CREDENTIALS GCLOUD_PROJECT_ID GOOGLE_CLOUD_PROJECT HEYGEN_CLIENT_SOURCE_ARGV HYPERFRAMES_MEDIA_HOME GROQ_API_KEY HYPERFRAMES_WHISPER_PATH MEDIA_USE_TELEMETRY_HOST OPENAI_API_KEY OPENVERSE_AUDIO_URL PREFERENCE_KEYS USERPROFILE

Package contents recorded 2026-10-22 at commit 4371981b740d. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

What we did not check

Sources

Related skills