Skills/npm/frameyard

frameyard@0.13.0

VERIFIED· install only

Publisher claims: "Local-first, deterministic video composition framework for HTML, CSS, and JavaScript." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher vladiantio · publishing for 16 daysInstalls 2,781Last detonated 2d ago
$claude mcp add frameyard -- npx -y frameyard
WatchReport an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-12 and scored it 87/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
npx invocation of non-well-known packagedist/cli.js:1131 · npx invocation of non-well-known package — may execute untrusted codenext: ["Add the register entry to fy.config.js", `npx frameyard lint ${id} --json`],Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/fonts/add.js:217 · npx invocation of non-well-known package — may execute untrusted code"npx frameyard context --json",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/context.js:151 · npx invocation of non-well-known package — may execute untrusted codereturn ["npx frameyard init <directory>"];Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/doctor.js:74 · npx invocation of non-well-known package — may execute untrusted codedetail: `Playwright Chromium is unavailable. Run "npx playwright install chromium". ${error instanceof Error ? error.message : String(error)}`,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/recipes.js:44 · npx invocation of non-well-known package — may execute untrusted code`npx frameyard check ${id}`,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/fonts/verify.js:103 · npx invocation of non-well-known package — may execute untrusted code…or(diagnostics, "FONT_HASH_MISMATCH", `Font hash changed for ${file.path}. Run "npx frameyard font add --force" or restore the file.`, font.id, file, { expected: file.sha256…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/html/validate.js:777 · npx invocation of non-well-known package — may execute untrusted codethis.warning("FONT_REMOTE", `Remote font or stylesheet URL "${url}" is not deterministic. Vendor the font into the project with "npx frameyard font add --file".`, { ...details, url });Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/fonts/add.js:216 · npx invocation of non-well-known package — may execute untrusted code"npx frameyard font verify --json",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/context.js:156 · npx invocation of non-well-known package — may execute untrusted codereturn [`npx frameyard lint ${target} --json`];Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/context.js:158 · npx invocation of non-well-known package — may execute untrusted codeconst commands = [`npx frameyard lint ${target} --json`];Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/context.js:162 · npx invocation of non-well-known package — may execute untrusted codecommands.push(`npx frameyard still ${target} --frame 0 --json`);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/context.js:160 · npx invocation of non-well-known package — may execute untrusted codecommands.push(`npx frameyard check ${target} --json`);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/recipes.js:43 · npx invocation of non-well-known package — may execute untrusted code"npx frameyard dev",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/cli.js:968 · npx invocation of non-well-known package — may execute untrusted code...(timeline !== undefined ? [`npx frameyard render ${timeline.id} --json`] : []),Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/preview/app.js:605 · npx invocation of non-well-known package — may execute untrusted code? { copyText: `npx frameyard still ${timelineId} --frame ${timelineMonitor.frame}` }Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/cli.js:1073 · npx invocation of non-well-known package — may execute untrusted code"Run npx frameyard context --json from the project",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/preview/app.js:538 · npx invocation of non-well-known package — may execute untrusted code: `npx frameyard still ${composition.id} --frame ${sourceMonitor.frame}`;Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/cli.js:967 · npx invocation of non-well-known package — may execute untrusted code...(lintTarget !== undefined ? [`npx frameyard lint ${lintTarget} --json`] : []),Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/recipes.js:51 · npx invocation of non-well-known package — may execute untrusted code`> Start from the \`${id}\` recipe. Keep the layout, replace the props and copy, and verify with \`npx frameyard check ${id}\`.`,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/scaffold.js:66 · npx invocation of non-well-known package — may execute untrusted code"npx frameyard check main",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/scaffold.js:67 · npx invocation of non-well-known package — may execute untrusted code"npx frameyard render main",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/scaffold.js:65 · npx invocation of non-well-known package — may execute untrusted code"npx frameyard dev",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/recipes.js:45 · npx invocation of non-well-known package — may execute untrusted code`npx frameyard still ${id} --frame 30 --out out/${id}.png`,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/recipes.js:46 · npx invocation of non-well-known package — may execute untrusted code`npx frameyard render ${id}`,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/scaffold.js:64 · npx invocation of non-well-known package — may execute untrusted code"npx frameyard doctor",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈46 tok
1 file · 81 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

No advisories in OSV for frameyard@0.13.0 as of 2d ago. This is the package itself, not its dependencies.