Skills/skills.sh/media-use

media-use@r12

VERIFIED· install only

Publisher claims: "Get or make any media for a HyperFrames video - music, sound effects, images, icons, logos, voiceover, avatar and generated video, transcripts, cutouts, colour grades and looks - with HeyGen or free local tools, and mix placed audio. Also for footage that looks dark, flat or dull, or should be stylized or hidden." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry skills.shPublisher heygen-com · publishing for 578 daysInstalls 1.4MLast detonated 4d ago
$npx skills add media-use
WatchReport an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is media-use@r12 safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-11 and scored it 81/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
npx invocation of non-well-known packageSKILL.md:8 · npx invocation of non-well-known package — may execute untrusted code…les](../hyperframes/references/plugin-installation.md). **Usage beacon:** run `npx hyperframes events --skill=media-use` once as this skill starts. It sends the skill's name …Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageSKILL.md:28 · npx invocation of non-well-known package — may execute untrusted code| Voiceover (`voice`) | Voice Turbo, Free plan: 3 min a month | Voice Turbo on a paid plan, other HeyGen voices, cloning | `npx hyperframes tts` (Kokoro on device) |Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageSKILL.md:15 · npx invocation of non-well-known package — may execute untrusted codenpx hyperframes media-use resolve --type <type> --intent "<what you need>" --project <dir>Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsaudio/scripts/lib/heygen.mjs:82 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Walk up ≤5 dirs from startDir; load the first .env (shell env always wins).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsaudio/scripts/lib/heygen.mjs:56 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// A missing `.env`, or a `.env` folder (some home dirs have one), is no env file: null. Read without checking first,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsaudio/scripts/lib/heygen.mjs:67 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// A project .env may supply provider keys and harmless settings only, the same policy as the CLI. EverythingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsaudio/scripts/lib/heygen.mjs:7 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// $HYPERFRAMES_API_KEY (or a nearby .env) → the API key saved inFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathsaudio/scripts/lib/heygen.test.mjs:232 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filestest("loadEnvFromDir skips a .env folder and loads the .env file above it", () => {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionaudio/scripts/heygen-tts.mjs:122 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`✓ ${output}${durStr}${wordCount ? ` · ${wordsPath} (${wordCount} words)` : ""}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/tts.mjs:150 · npx invocation of non-well-known package — may execute untrusted code// runs that same build with the same Node instead of whatever npx resolves from the project.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/heygen.mjs:242 · npx invocation of non-well-known package — may execute untrusted codereturn "This needs a HyperFrames plan. Run `npx hyperframes billing subscribe --skill media-use`: it opens the page and waits.";Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/tts.mjs:301 · npx invocation of non-well-known package — may execute untrusted codereturn synthResult(r, wavAbs, "kokoro (npx hyperframes tts)");Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/tts.mjs:149 · npx invocation of non-well-known package — may execute untrusted code// A HyperFrames CLI that launches this code hands over its own entry file, so `npx hyperframes`Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/tts.cleanup.test.mjs:96 · npx invocation of non-well-known package — may execute untrusted codeconst label = provider === "elevenlabs" ? "elevenlabs (python)" : "kokoro (npx hyperframes tts)";Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/tts.spawn.test.mjs:68 · npx invocation of non-well-known package — may execute untrusted codetest("resolveSpawnCommand preserves Windows npx shell metacharacters as argv data", () => {Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/heygen.mjs:199 · npx invocation of non-well-known package — may execute untrusted code`HeyGen credentials at ${cred.unreadable.file} can't be read (${cred.unreadable.code}) — fix or remove that path, then run \`npx hyperframes auth login\``,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedaudio/scripts/extract-audio-data.py:60 · Python subprocess execution detectedresult = subprocess.run(cmd, capture_output=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packageSKILL.md:31 · npx invocation of non-well-known package — may execute untrusted code| Cutouts | | Video: `--type cutout` | `npx hyperframes remove-background` |Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/tts.spawn.test.mjs:81 · npx invocation of non-well-known package — may execute untrusted codetest("spawnP uses the resolved node+npx-cli command for npx on win32", async () => {Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
File type combined with upload actionaudio/scripts/audio.mjs:28 · File type combined with upload action — agent may exfiltrate local data files// ── audio_meta.json (output, id-keyed) ───────────────────────────────────────Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/tts.mjs:171 · npx invocation of non-well-known package — may execute untrusted code// On Windows, npx resolves to npx.cmd, which Node cannot execute directly.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/tts.test.mjs:168 · npx invocation of non-well-known package — may execute untrusted code// Kokoro shells out to `npx hyperframes tts`; a fake npx on PATH records the argvFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Access to sensitive file pathsaudio/scripts/gemini-pipeline.test.mjs:67 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileswriteFileSync(join(dir, ".env"), "");Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/tts.spawn.test.mjs:12 · npx invocation of non-well-known package — may execute untrusted code// Regression: on Windows, npx resolves to npx.cmd, which spawn() cannot execFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
File type combined with upload actionaudio/scripts/lib/tts.cleanup.test.mjs:27 · File type combined with upload action — agent may exfiltrate local data filesfs.writeFileSync(output + ".json", JSON.stringify({ input, text, consumed, args }));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/tts.spawn.test.mjs:98 · npx invocation of non-well-known package — may execute untrusted codetest("spawnP does not enable shell for npx on darwin/linux", async () => {Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/heygen.test.mjs:431 · npx invocation of non-well-known package — may execute untrusted code"This needs a HyperFrames plan. Run `npx hyperframes billing subscribe --skill media-use`: it opens the page and waits.",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/tts.spawn.test.mjs:46 · npx invocation of non-well-known package — may execute untrusted codetest("resolveSpawnCommand routes npx through node+npx-cli on win32 without shell:true", () => {Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
Access to sensitive file pathsaudio/scripts/lib/heygen.test.mjs:249 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filestest("a project's .env supplies provider keys only, never programs, runtime options or another account", () => {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathsaudio/scripts/lib/heygen.test.mjs:236 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileswriteFileSync(join(root, ".env"), "ELEVENLABS_API_KEY=from-parent\n");Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionaudio/scripts/audio.mjs:15 · File type combined with upload action — agent may exfiltrate local data files// ── audio_request.json (input) ────────────────────────────────────────────────Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/heygen.test.mjs:435 · npx invocation of non-well-known package — may execute untrusted code"Out of HyperFrames credits. Run `npx hyperframes billing add-credits --skill media-use`: it opens the page and waits.",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/heygen.mjs:206 · npx invocation of non-well-known package — may execute untrusted code"no HyperFrames credentials — set $HEYGEN_API_KEY, or run `npx hyperframes auth login` (writes ~/.hyperframes/credentials)",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/heygen.mjs:203 · npx invocation of non-well-known package — may execute untrusted code"HeyGen OAuth token expired — run `npx hyperframes auth refresh` (or `npx hyperframes auth login`)",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionaudio/scripts/gemini-pipeline.test.mjs:44 · File type combined with upload action — agent may exfiltrate local data filesreturn Response.json({status:'completed', steps:[{type:'model_output', content:[Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionaudio/scripts/extract-audio-data.py:180 · File type combined with upload action — agent may exfiltrate local data filesparser.add_argument("-o", "--output", default="audio-data.json", help="Output JSON path")Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Access to sensitive file pathsaudio/scripts/lib/heygen.test.mjs:235 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesmkdirSync(join(project, ".env"), { recursive: true });Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packageSKILL.md:30 · npx invocation of non-well-known package — may execute untrusted code| Transcripts | `npx hyperframes transcribe` (Parakeet or whisper) | | |Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/tts.test.mjs:163 · npx invocation of non-well-known package — may execute untrusted codeconst res = synthResult({ status: 2 }, "/tmp/none.wav", "kokoro (npx hyperframes tts)");Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/tts.test.mjs:169 · npx invocation of non-well-known package — may execute untrusted code// synthesizeOne really builds, so a dropped flag fails here. Windows runs npx viaFix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈1,327 tok
1 file · 60 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.