media-use@r14
VERIFIED· install onlyPublisher claims: "Get or make any media for a HyperFrames video - music, sound effects, images, icons, logos, voiceover, avatar and generated video, transcripts, cutouts, colour grades and looks - with HeyGen or free local tools, and mix placed audio. Also for footage that looks dark, flat or dull, or should be stylized or hidden." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry skills.shPublisher heygen-com · publishing for 578 daysInstalls 1.4MLast detonated 34 h ago
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is media-use@r14 safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-13 and scored it 81/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run
Static findings
HIGH
Access to sensitive file pathsaudio/scripts/lib/heygen.mjs:67 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// A project .env may supply provider keys and harmless settings only, the same policy as the CLI. EverythingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsaudio/scripts/lib/heygen.mjs:56 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// A missing `.env`, or a `.env` folder (some home dirs have one), is no env file: null. Read without checking first,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packageSKILL.md:15 · npx invocation of non-well-known package — may execute untrusted code
AST06npx hyperframes media-use resolve --type <type> --intent "<what you need>" --project <dir>Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathsaudio/scripts/lib/heygen.mjs:82 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// Walk up ≤5 dirs from startDir; load the first .env (shell env always wins).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packageSKILL.md:28 · npx invocation of non-well-known package — may execute untrusted code
AST06| Voiceover (`voice`) | Voice Turbo, Free plan: 3 min a month | Voice Turbo on a paid plan, other HeyGen voices, cloning | `npx hyperframes tts` (Kokoro on device) |Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packageSKILL.md:8 · npx invocation of non-well-known package — may execute untrusted code
AST06…les](../hyperframes/references/plugin-installation.md). **Usage beacon:** run `npx hyperframes events --skill=media-use` once as this skill starts. It sends the skill's name …Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathsaudio/scripts/lib/heygen.mjs:7 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// $HYPERFRAMES_API_KEY (or a nearby .env) → the API key saved inFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/tts.spawn.test.mjs:81 · npx invocation of non-well-known package — may execute untrusted code
AST06test("spawnP uses the resolved node+npx-cli command for npx on win32", async () => {Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File type combined with upload actionaudio/scripts/audio.mjs:28 · File type combined with upload action — agent may exfiltrate local data files
AST07// ── audio_meta.json (output, id-keyed) ───────────────────────────────────────Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Access to sensitive file pathsaudio/scripts/lib/heygen.test.mjs:249 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05test("a project's .env supplies provider keys only, never programs, runtime options or another account", () => {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/tts.mjs:157 · npx invocation of non-well-known package — may execute untrusted code
AST06// letting npx resolve `hyperframes` from the project.Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actionaudio/scripts/extract-audio-data.py:182 · File type combined with upload action — agent may exfiltrate local data files
AST07parser.add_argument("-o", "--output", default="audio-data.json", help="Output JSON path")Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packageSKILL.md:30 · npx invocation of non-well-known package — may execute untrusted code
AST06| Transcripts | `npx hyperframes transcribe` (Parakeet or whisper) | | |Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/heygen.test.mjs:435 · npx invocation of non-well-known package — may execute untrusted code
AST06"Out of HyperFrames credits. Run `npx hyperframes billing add-credits --skill media-use`: it opens the page and waits.",Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/tts.spawn.test.mjs:12 · npx invocation of non-well-known package — may execute untrusted code
AST06// Regression: on Windows, npx resolves to npx.cmd, which spawn() cannot execFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File type combined with upload actionaudio/scripts/heygen-tts.mjs:122 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(`✓ ${output}${durStr}${wordCount ? ` · ${wordsPath} (${wordCount} words)` : ""}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/tts.test.mjs:165 · npx invocation of non-well-known package — may execute untrusted code
AST06const res = synthResult({ status: 2 }, "/tmp/none.wav", "kokoro (npx hyperframes tts)");Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Access to sensitive file pathsaudio/scripts/lib/heygen.test.mjs:235 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05mkdirSync(join(project, ".env"), { recursive: true });Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/tts.spawn.test.mjs:68 · npx invocation of non-well-known package — may execute untrusted code
AST06test("resolveSpawnCommand preserves Windows npx shell metacharacters as argv data", () => {Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File type combined with upload actionaudio/scripts/gemini-pipeline.test.mjs:44 · File type combined with upload action — agent may exfiltrate local data files
AST07return Response.json({status:'completed', steps:[{type:'model_output', content:[Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/heygen.mjs:203 · npx invocation of non-well-known package — may execute untrusted code
AST06"HeyGen OAuth token expired — run `npx hyperframes auth refresh` (or `npx hyperframes auth login`)",Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/tts.spawn.test.mjs:98 · npx invocation of non-well-known package — may execute untrusted code
AST06test("spawnP does not enable shell for npx on darwin/linux", async () => {Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Access to sensitive file pathsaudio/scripts/gemini-pipeline.test.mjs:66 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05writeFileSync(join(dir, ".env"), "");Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/heygen.mjs:242 · npx invocation of non-well-known package — may execute untrusted code
AST06return "This needs a HyperFrames plan. Run `npx hyperframes billing subscribe --skill media-use`: it opens the page and waits.";Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actionaudio/scripts/lib/tts.cleanup.test.mjs:27 · File type combined with upload action — agent may exfiltrate local data files
AST07fs.writeFileSync(output + ".json", JSON.stringify({ input, text, consumed, args }));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Access to sensitive file pathsaudio/scripts/lib/heygen.test.mjs:232 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05test("loadEnvFromDir skips a .env folder and loads the .env file above it", () => {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/tts.mjs:156 · npx invocation of non-well-known package — may execute untrusted code
AST06// `npx hyperframes` runs that same CLI with the same Node. Without one it fails rather thanFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Access to sensitive file pathsaudio/scripts/lib/heygen.test.mjs:236 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05writeFileSync(join(root, ".env"), "ELEVENLABS_API_KEY=from-parent\n");Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/tts.spawn.test.mjs:46 · npx invocation of non-well-known package — may execute untrusted code
AST06test("resolveSpawnCommand routes npx through node+npx-cli on win32 without shell:true", () => {Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/tts.mjs:179 · npx invocation of non-well-known package — may execute untrusted code
AST06// On Windows, npx resolves to npx.cmd, which Node cannot execute directly.Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packageSKILL.md:31 · npx invocation of non-well-known package — may execute untrusted code
AST06| Cutouts | | Video: `--type cutout` | `npx hyperframes remove-background` |Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/heygen.mjs:206 · npx invocation of non-well-known package — may execute untrusted code
AST06"no HyperFrames credentials — set $HEYGEN_API_KEY, or run `npx hyperframes auth login` (writes ~/.hyperframes/credentials)",Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/tts.cleanup.test.mjs:96 · npx invocation of non-well-known package — may execute untrusted code
AST06const label = provider === "elevenlabs" ? "elevenlabs (python)" : "kokoro (npx hyperframes tts)";Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/heygen.mjs:199 · npx invocation of non-well-known package — may execute untrusted code
AST06`HeyGen credentials at ${cred.unreadable.file} can't be read (${cred.unreadable.code}) — fix or remove that path, then run \`npx hyperframes auth login\``,Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/tts.mjs:320 · npx invocation of non-well-known package — may execute untrusted code
AST06return synthResult(r, wavAbs, "kokoro (npx hyperframes tts)");Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actionaudio/scripts/audio.mjs:15 · File type combined with upload action — agent may exfiltrate local data files
AST07// ── audio_request.json (input) ────────────────────────────────────────────────Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Python subprocess execution detectedaudio/scripts/extract-audio-data.py:62 · Python subprocess execution detected
AST05result = subprocess.run(cmd, capture_output=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
npx invocation of non-well-known packageaudio/scripts/lib/heygen.test.mjs:431 · npx invocation of non-well-known package — may execute untrusted code
AST06"This needs a HyperFrames plan. Run `npx hyperframes billing subscribe --skill media-use`: it opens the page and waits.",Fix: Pin versions and sources; vendor anything fetched at install time.Cost to the agent
Instructions loaded
≈1,328 tok
1 file · 60 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.