remotion-to-hyperframes

SAFE max severity MEDIUMSkillSpector Do not install 71 registry heygen-com last scanned 1 scan

Verdict safe, but 17 findings (3 medium, 13 low, 1 info), mainly supply chain attack, data exfiltration, policy violation. Most recent scan 2026-10-22.

Findings17
Critical0
High0
Medium3
Low13
Analyzersstatic bytecode pipeline correlation behavioral trigger
Scanner version2.3.1

Second scanner: NVIDIA SkillSpector

VerdictDo not install 71
Score71 / 100
Issues41
CategoriesSupply Chain MCP Rug Pull Memory Poisoning
Version2.12.0 (static)

The two scanners disagree: Cisco found nothing and SkillSpector says do not install. One of them has a blind spot here; read the skill before trusting either. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Bring existing video code or footage into HyperFrames and verify it frame by frame against the original - Remotion first, also Motion Canvas, Lottie, Three.js, p5.js, canvas or plain HTML/CSS animation, or renders from Manim, After Effects or Blender. Use to port, convert, migrate or reuse work made with another tool.

Package
77 files, 170 KB
SKILL.md
618 words, 4 sections
Code
TypeScript (28), Shell (6), Python (1)

SKILL.md covers: Import into HyperFrames · Native: translate, then verify · Hosted · Media

Findings

MEDIUM Outbound network request primitives in JavaScript/TypeScript Data Exfiltrationstatic

Pattern detected: fetch(

assets/test-corpus/tier-4-escape-hatch/cases/03-async-metadata.tsx:31

const response = await fetch(
Remediation: Ensure network operations are necessary and document allowed destinations
MEDIUM Outbound network request primitives in JavaScript/TypeScript Data Exfiltrationstatic

Pattern detected: fetch(

assets/test-corpus/tier-4-escape-hatch/cases/08-mixed.tsx:25

fetch("/api/items")
Remediation: Ensure network operations are necessary and document allowed destinations
MEDIUM File extension does not match actual content type Obfuscationstatic

File 'render_diff.sh' extension (.sh) suggests one format but Magika detected a different text format: Python source (python). This may indicate content obfuscation or a misnamed file.

scripts/render_diff.sh

Remediation: Rename the file to match its actual content type, or remove it if it appears malicious.
LOW Unpinned dependency Supply Chain Attackstatic

Dependency '@remotion/cli' has no exact version. Unpinned dependencies in a skill package allow a later, potentially malicious release to be installed automatically (supply-chain risk).

assets/test-corpus/tier-1-title-card/remotion-src/package.json:9

"@remotion/cli": "^4.0.0"
Remediation: Pin the dependency to an exact version (e.g. '"package": "1.2.3"').
LOW Unpinned dependency Supply Chain Attackstatic

Dependency 'react' has no exact version. Unpinned dependencies in a skill package allow a later, potentially malicious release to be installed automatically (supply-chain risk).

assets/test-corpus/tier-1-title-card/remotion-src/package.json:10

"react": "^18.3.1"
Remediation: Pin the dependency to an exact version (e.g. '"package": "1.2.3"').
LOW Unpinned dependency Supply Chain Attackstatic

Dependency 'react-dom' has no exact version. Unpinned dependencies in a skill package allow a later, potentially malicious release to be installed automatically (supply-chain risk).

assets/test-corpus/tier-1-title-card/remotion-src/package.json:11

"react-dom": "^18.3.1"
Remediation: Pin the dependency to an exact version (e.g. '"package": "1.2.3"').
LOW Unpinned dependency Supply Chain Attackstatic

Dependency 'remotion' has no exact version. Unpinned dependencies in a skill package allow a later, potentially malicious release to be installed automatically (supply-chain risk).

assets/test-corpus/tier-1-title-card/remotion-src/package.json:12

"remotion": "^4.0.0"
Remediation: Pin the dependency to an exact version (e.g. '"package": "1.2.3"').
LOW Unpinned dependency Supply Chain Attackstatic

Dependency '@remotion/cli' has no exact version. Unpinned dependencies in a skill package allow a later, potentially malicious release to be installed automatically (supply-chain risk).

assets/test-corpus/tier-2-multi-scene/remotion-src/package.json:9

"@remotion/cli": "^4.0.0"
Remediation: Pin the dependency to an exact version (e.g. '"package": "1.2.3"').
LOW Unpinned dependency Supply Chain Attackstatic

Dependency 'react' has no exact version. Unpinned dependencies in a skill package allow a later, potentially malicious release to be installed automatically (supply-chain risk).

assets/test-corpus/tier-2-multi-scene/remotion-src/package.json:10

"react": "^18.3.1"
Remediation: Pin the dependency to an exact version (e.g. '"package": "1.2.3"').
LOW Unpinned dependency Supply Chain Attackstatic

Dependency 'react-dom' has no exact version. Unpinned dependencies in a skill package allow a later, potentially malicious release to be installed automatically (supply-chain risk).

assets/test-corpus/tier-2-multi-scene/remotion-src/package.json:11

"react-dom": "^18.3.1"
Remediation: Pin the dependency to an exact version (e.g. '"package": "1.2.3"').
LOW Unpinned dependency Supply Chain Attackstatic

Dependency 'remotion' has no exact version. Unpinned dependencies in a skill package allow a later, potentially malicious release to be installed automatically (supply-chain risk).

assets/test-corpus/tier-2-multi-scene/remotion-src/package.json:12

"remotion": "^4.0.0"
Remediation: Pin the dependency to an exact version (e.g. '"package": "1.2.3"').
LOW Unpinned dependency Supply Chain Attackstatic

Dependency '@remotion/cli' has no exact version. Unpinned dependencies in a skill package allow a later, potentially malicious release to be installed automatically (supply-chain risk).

assets/test-corpus/tier-3-data-driven/remotion-src/package.json:9

"@remotion/cli": "^4.0.0"
Remediation: Pin the dependency to an exact version (e.g. '"package": "1.2.3"').
LOW Unpinned dependency Supply Chain Attackstatic

Dependency 'react' has no exact version. Unpinned dependencies in a skill package allow a later, potentially malicious release to be installed automatically (supply-chain risk).

assets/test-corpus/tier-3-data-driven/remotion-src/package.json:10

"react": "^18.3.1"
Remediation: Pin the dependency to an exact version (e.g. '"package": "1.2.3"').
LOW Unpinned dependency Supply Chain Attackstatic

Dependency 'react-dom' has no exact version. Unpinned dependencies in a skill package allow a later, potentially malicious release to be installed automatically (supply-chain risk).

assets/test-corpus/tier-3-data-driven/remotion-src/package.json:11

"react-dom": "^18.3.1"
Remediation: Pin the dependency to an exact version (e.g. '"package": "1.2.3"').
LOW Unpinned dependency Supply Chain Attackstatic

Dependency 'remotion' has no exact version. Unpinned dependencies in a skill package allow a later, potentially malicious release to be installed automatically (supply-chain risk).

assets/test-corpus/tier-3-data-driven/remotion-src/package.json:12

"remotion": "^4.0.0"
Remediation: Pin the dependency to an exact version (e.g. '"package": "1.2.3"').
LOW Unpinned dependency Supply Chain Attackstatic

Dependency 'zod' has no exact version. Unpinned dependencies in a skill package allow a later, potentially malicious release to be installed automatically (supply-chain risk).

assets/test-corpus/tier-3-data-driven/remotion-src/package.json:13

"zod": "^3.22.0"
Remediation: Pin the dependency to an exact version (e.g. '"package": "1.2.3"').
INFO Skill does not specify a license Policy Violationstatic

Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

SKILL.md

Remediation: Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)

What is in the package

77 files, 170 KB. Show the list.
FileKindSize
SKILL.mddoc4.8 KB
assets/.gitkeepother0 B
references/api-map.mddoc15 KB
references/escape-hatch.mddoc5.3 KB
references/eval.mddoc5.5 KB
references/fonts.mddoc3.2 KB
references/limitations.mddoc4.9 KB
references/lottie.mddoc4.1 KB
references/media.mddoc4.4 KB
references/parameters.mddoc4.8 KB
references/sequencing.mddoc6.8 KB
references/timing.mddoc6.1 KB
references/transitions.mddoc4.4 KB
scripts/.gitkeepother0 B
scripts/frame_strip.shscript3.6 KB
scripts/lint_source.pyscript13 KB
scripts/render_diff.shscript3.0 KB
assets/test-corpus/.gitignoreother16 B
assets/test-corpus/run.shscript8.2 KB
scripts/tests/smoke.shscript3.5 KB
assets/test-corpus/tier-1-title-card/.gitignoreother128 B
assets/test-corpus/tier-1-title-card/README.mddoc2.2 KB
assets/test-corpus/tier-1-title-card/expected.jsonconfig1.7 KB
assets/test-corpus/tier-2-multi-scene/.gitignoreother215 B
assets/test-corpus/tier-2-multi-scene/README.mddoc3.2 KB
assets/test-corpus/tier-2-multi-scene/expected.jsonconfig2.1 KB
assets/test-corpus/tier-2-multi-scene/setup.shscript1.2 KB
assets/test-corpus/tier-3-data-driven/.gitignoreother128 B
assets/test-corpus/tier-3-data-driven/README.mddoc4.9 KB
assets/test-corpus/tier-3-data-driven/expected.jsonconfig3.4 KB
assets/test-corpus/tier-4-escape-hatch/README.mddoc2.8 KB
assets/test-corpus/tier-4-escape-hatch/expected.jsonconfig2.7 KB
assets/test-corpus/tier-4-escape-hatch/validate.shscript3.5 KB
scripts/tests/fixtures/blocker.tsxscript1.8 KB
scripts/tests/fixtures/clean.tsxscript1.3 KB
assets/test-corpus/tier-1-title-card/hf-src/index.htmldata1.1 KB
assets/test-corpus/tier-1-title-card/remotion-src/package.jsonconfig296 B
assets/test-corpus/tier-1-title-card/remotion-src/remotion.config.tsscript497 B
assets/test-corpus/tier-1-title-card/remotion-src/tsconfig.jsonconfig337 B
assets/test-corpus/tier-2-multi-scene/hf-src/index.htmldata1.7 KB
assets/test-corpus/tier-2-multi-scene/remotion-src/package.jsonconfig298 B
assets/test-corpus/tier-2-multi-scene/remotion-src/remotion.config.tsscript497 B
assets/test-corpus/tier-2-multi-scene/remotion-src/tsconfig.jsonconfig337 B
assets/test-corpus/tier-3-data-driven/hf-src/index.htmldata1.7 KB
assets/test-corpus/tier-3-data-driven/remotion-src/package.jsonconfig319 B
assets/test-corpus/tier-3-data-driven/remotion-src/remotion.config.tsscript497 B
assets/test-corpus/tier-3-data-driven/remotion-src/tsconfig.jsonconfig337 B
assets/test-corpus/tier-4-escape-hatch/cases/01-use-state.tsxscript1000 B
assets/test-corpus/tier-4-escape-hatch/cases/02-use-effect-deps.tsxscript954 B
assets/test-corpus/tier-4-escape-hatch/cases/03-async-metadata.tsxscript1.1 KB
assets/test-corpus/tier-4-escape-hatch/cases/04-third-party-react.tsxscript1.2 KB
assets/test-corpus/tier-4-escape-hatch/cases/05-lambda-config.tsxscript1.4 KB
assets/test-corpus/tier-4-escape-hatch/cases/06-warnings-only.tsxscript1.4 KB
assets/test-corpus/tier-4-escape-hatch/cases/07-custom-hook.tsxscript1.1 KB
assets/test-corpus/tier-4-escape-hatch/cases/08-mixed.tsxscript1.1 KB
assets/test-corpus/tier-1-title-card/hf-src/compositions/title.htmldata1.1 KB
assets/test-corpus/tier-1-title-card/remotion-src/src/Root.tsxscript259 B
assets/test-corpus/tier-1-title-card/remotion-src/src/TitleCard.tsxscript773 B
assets/test-corpus/tier-1-title-card/remotion-src/src/index.tsscript109 B
assets/test-corpus/tier-2-multi-scene/hf-src/compositions/scene-1.htmldata1.1 KB
assets/test-corpus/tier-2-multi-scene/hf-src/compositions/scene-2.htmldata1.1 KB
assets/test-corpus/tier-2-multi-scene/hf-src/compositions/scene-3.htmldata1004 B
assets/test-corpus/tier-2-multi-scene/remotion-src/src/MultiScene.tsxscript2.3 KB
assets/test-corpus/tier-2-multi-scene/remotion-src/src/Root.tsxscript264 B
assets/test-corpus/tier-2-multi-scene/remotion-src/src/index.tsscript109 B
assets/test-corpus/tier-3-data-driven/hf-src/compositions/scene-1.htmldata1.6 KB
assets/test-corpus/tier-3-data-driven/hf-src/compositions/scene-2.htmldata3.0 KB
assets/test-corpus/tier-3-data-driven/hf-src/compositions/scene-3.htmldata1.6 KB
assets/test-corpus/tier-3-data-driven/remotion-src/src/Root.tsxscript681 B
assets/test-corpus/tier-3-data-driven/remotion-src/src/Stargazed.tsxscript970 B
assets/test-corpus/tier-3-data-driven/remotion-src/src/index.tsscript109 B
assets/test-corpus/tier-3-data-driven/remotion-src/src/components/AnimatedNumber.tsxscript740 B
assets/test-corpus/tier-3-data-driven/remotion-src/src/components/StatCard.tsxscript1.4 KB
assets/test-corpus/tier-3-data-driven/remotion-src/src/components/UnderlinedText.tsxscript1.1 KB
assets/test-corpus/tier-3-data-driven/remotion-src/src/scenes/OutroScene.tsxscript423 B
assets/test-corpus/tier-3-data-driven/remotion-src/src/scenes/StatsScene.tsxscript676 B
assets/test-corpus/tier-3-data-driven/remotion-src/src/scenes/TitleScene.tsxscript1.2 KB

External hosts referenced

github.com cdnjs.cloudflare.com hyperframes.heygen.com fonts.googleapis.com fonts.gstatic.com other-domain.com unpkg.com

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Environment variables referenced

THIS_DIR SCRIPTS_DIR OUTDIR SKILL_DIR HF_CLI RESULTS_DIR R2HF_SSIM_THRESHOLD PASS REPORT

Package contents recorded 2026-10-22 at commit 4371981b740d. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

What we did not check

Sources

Related skills