frameyard@0.12.1
VERIFIED· install onlyPublisher claims: "Local-first, deterministic video composition framework for HTML, CSS, and JavaScript." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher vladiantio · publishing for 16 daysInstalls 2,781Last detonated 4d ago
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-10 and scored it 87/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run
Static findings
MEDIUM
npx invocation of non-well-known packagedist/fonts/verify.js:103 · npx invocation of non-well-known package — may execute untrusted code
AST06…or(diagnostics, "FONT_HASH_MISMATCH", `Font hash changed for ${file.path}. Run "npx frameyard font add --force" or restore the file.`, font.id, file, { expected: file.sha256…Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/preview/app.js:515 · npx invocation of non-well-known package — may execute untrusted code
AST06: `npx frameyard still ${composition.id} --frame ${sourceMonitor.frame}`;Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/cli.js:1131 · npx invocation of non-well-known package — may execute untrusted code
AST06next: ["Add the register entry to fy.config.js", `npx frameyard lint ${id} --json`],Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/recipes.js:46 · npx invocation of non-well-known package — may execute untrusted code
AST06`npx frameyard render ${id}`,Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/context.js:160 · npx invocation of non-well-known package — may execute untrusted code
AST06commands.push(`npx frameyard check ${target} --json`);Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/cli.js:968 · npx invocation of non-well-known package — may execute untrusted code
AST06...(timeline !== undefined ? [`npx frameyard render ${timeline.id} --json`] : []),Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/scaffold.js:65 · npx invocation of non-well-known package — may execute untrusted code
AST06"npx frameyard dev",Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/context.js:162 · npx invocation of non-well-known package — may execute untrusted code
AST06commands.push(`npx frameyard still ${target} --frame 0 --json`);Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/scaffold.js:64 · npx invocation of non-well-known package — may execute untrusted code
AST06"npx frameyard doctor",Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/cli.js:1073 · npx invocation of non-well-known package — may execute untrusted code
AST06"Run npx frameyard context --json from the project",Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/html/validate.js:690 · npx invocation of non-well-known package — may execute untrusted code
AST06this.warning("FONT_REMOTE", `Remote font or stylesheet URL "${url}" is not deterministic. Vendor the font into the project with "npx frameyard font add --file".`, { ...details, url });Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/scaffold.js:67 · npx invocation of non-well-known package — may execute untrusted code
AST06"npx frameyard render main",Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/context.js:151 · npx invocation of non-well-known package — may execute untrusted code
AST06return ["npx frameyard init <directory>"];Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/recipes.js:43 · npx invocation of non-well-known package — may execute untrusted code
AST06"npx frameyard dev",Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/recipes.js:44 · npx invocation of non-well-known package — may execute untrusted code
AST06`npx frameyard check ${id}`,Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/doctor.js:74 · npx invocation of non-well-known package — may execute untrusted code
AST06detail: `Playwright Chromium is unavailable. Run "npx playwright install chromium". ${error instanceof Error ? error.message : String(error)}`,Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/fonts/add.js:217 · npx invocation of non-well-known package — may execute untrusted code
AST06"npx frameyard context --json",Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/context.js:158 · npx invocation of non-well-known package — may execute untrusted code
AST06const commands = [`npx frameyard lint ${target} --json`];Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/recipes.js:45 · npx invocation of non-well-known package — may execute untrusted code
AST06`npx frameyard still ${id} --frame 30 --out out/${id}.png`,Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/recipes.js:51 · npx invocation of non-well-known package — may execute untrusted code
AST06`> Start from the \`${id}\` recipe. Keep the layout, replace the props and copy, and verify with \`npx frameyard check ${id}\`.`,Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/cli.js:967 · npx invocation of non-well-known package — may execute untrusted code
AST06...(lintTarget !== undefined ? [`npx frameyard lint ${lintTarget} --json`] : []),Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/fonts/add.js:216 · npx invocation of non-well-known package — may execute untrusted code
AST06"npx frameyard font verify --json",Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/scaffold.js:66 · npx invocation of non-well-known package — may execute untrusted code
AST06"npx frameyard check main",Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/preview/app.js:580 · npx invocation of non-well-known package — may execute untrusted code
AST06? { copyText: `npx frameyard still ${timelineId} --frame ${timelineMonitor.frame}` }Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/context.js:156 · npx invocation of non-well-known package — may execute untrusted code
AST06return [`npx frameyard lint ${target} --json`];Fix: Pin versions and sources; vendor anything fetched at install time.Cost to the agent
Instructions loaded
≈46 tok
1 file · 81 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
No advisories in OSV for frameyard@0.12.1 as of 4d ago. This is the package itself, not its dependencies.