·
Last changedVersion:
This version passed the hardening gate. Hardening updated the skill content and independently checked the resulting changes. Classified findings before hardening: 17. Classified findings closed: 2. Classified findings remaining: 15. Unclassified scanner findings remaining: 0. Review findings closed: 6. Review findings remaining: 9.
2
15
15
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
SKILL.md | Safety Bypass & Harmful Content | — | High | Closed | |
references/capability-menu.md | Supply Chain & Install-Time Trust | — | Medium | Open | |
references/intent-interview.md | Excessive Agency & Rogue Autonomy | — | Medium | Open | |
references/brief-contract.md | Prompt Injection | Direct prompt injection | Medium | Open | |
references/capability-menu.md | Memory & Context Poisoning | — | Medium | Open | |
references/script-format.md | Prompt Injection | Direct prompt injection | Medium | Open | |
references/intent-interview.md | Prompt Injection | Direct prompt injection | Medium | Open | |
references/skill-lifecycle.md | Supply Chain & Install-Time Trust | — | Medium | Open |
17 findings
HyperFrames renders video from HTML — a composition is an HTML file whose DOM declares timing with data-* attributes, whose animation runtime is seekable, and whose media playback is owned by the framework. The full authoring contract lives in /hyperframes-core; read it before writing composition HTML. Brief, storyboard, review, production, dispatch, and frame-worker contracts live in this skill's references/.
Apply the first matching row; do not evaluate lower state rows:
| State | Action |
|---|---|
Explicit port of existing Remotion source to HyperFrames | Read |
Specific operation on an existing HyperFrames project: inspect, diagnose, validate, preview, render, publish, or batch-render | Perform only that operation. Skip intent and workflow routing; load |
Specific edit to an existing project | Make the edit. Do not run the intent layer. To know what is on a project's timeline (tracks, clips, starts, ends, what plays), run |
| Read |
No brief, but | Resume from project files and recorded preferences. Infer the owning workflow from existing artifacts. If it cannot be determined uniquely, ask one routing-only question; do not run the intent interview. |
Fresh creation | Run the intent layer — |
If a fresh request does not identify the subject or input, ask what the video is about before routing. Check preferences and recipes before asking anything (references/intent-interview.md, step 1). A figma.com input or a named recipe changes intake, not routing — the interview's "Adapt orthogonal inputs" section handles both.
Use the first matching row. Match the requested deliverable, not a word or file type mentioned in passing.
| Priority | Request | Workflow |
|---|---|---|
1 | Explicitly port an existing Remotion source |
|
2 | Author a presentation, pitch deck, or navigable interactive deck |
|
3 | Add plain captions or subtitles to existing talking-head footage without changing it |
|
4 | Add designed graphic overlays to existing talking-head, interview, or podcast footage without changing the footage |
|
5 | Build a beat-synced video from a music track, with no narration or website capture |
|
6 | Create an explicitly short, unnarrated, motion-first unit, typically under 10s |
|
7 | Explain a GitHub pull request or code change from a PR reference |
|
8 | Market or showcase a website, product site, app, or company from a URL or site-specific brief |
|
9 | Explain a topic, article, or notes with invented visuals and no product or site capture |
|
10 | Any other custom video or composition |
|
Before finalizing the route, read references/routes/<workflow>.md — one small file per route: the canonical input/output/trigger contract (available before lazy-installed workflow skills are present) plus that route's interview entry. If the candidate does not satisfy its contract, continue routing instead of forcing the match. Read only the matched route's file.
/motion-graphics when it is unnarrated and motion is the message. A static title card, narrated sequence, longer montage, or custom loop is /general-video./product-launch-video./embedded-captions; footage with designed information cards routes to /talking-head-recut. Retiming, reordering, recoloring, reframing, or remixing footage is a custom edit and falls through to /general-video./music-to-video only when its beat grid drives the piece. Music used as a bed does not override the subject-matched route./general-video. A confirmed sketched storyboard.html may itself be the requested deliverable; the review loop defines that stop point./general-video. Length never overrides an explicit port, deck, caption, overlay, or music-driven deliverable.For fresh creation the intent layer (references/intent-interview.md) runs the full conversation — memory, triage, pitch round, must-haves, run-shape, hand-off — and ends by writing BRIEF.md. The brief is the only routing artifact the workflow reads; nothing later re-opens this skill or the interview. Answer every later "what did the route require?" from BRIEF.md.
Before reading the selected workflow, install or refresh it and the core domain skills:
Use the bare name without /. If the command fails, surface the error; do not reconstruct the workflow from memory. Everything else about installation — the core-vs-lazy split, what init refreshes, diagnosis, CI opt-out, and the no-CLI fallback — lives in references/skill-lifecycle.md.
| Need | Skill |
|---|---|
Composition structure, timing attributes, tracks, variables, determinism |
|
Motion rules, scene blueprints, transitions, runtime adapters |
|
Seek-safe GSAP, CSS, Anime.js, WAAPI, FLIP, paths, masks, SVG, 3D keyframes, or |
|
Design specs, concept, palette, typography, narration, beat planning |
|
Images, icons, logos, audio, captions, grades, LUTs, reusable media |
|
Voiceover carve, audio effect chains, automation envelopes, or one chain/fader across several tracks (submix bus) |
|
Init, lint, check, snapshots, compare, batch render, Studio, render, publish, or diagnostics |
|
Registry blocks and components |
|
A named look, effect, treatment, or transition — CRT scanlines, glitch, film grain, shimmer sweep, confetti burst — BEFORE hand-building it |
|
Figma assets, tokens, components, or storyboard frames as reconstructed motion |
|
Creator edit phrases are cross-domain requests. Load every skill named in the matching row:
| Creator request | Required domains |
|---|---|
“cut this footage”, hard cut, trim, splice, reorder, or use a source range |
|
zoom in here, punch-in / punch-out, smooth multi-state zoom or reframe, Ken Burns, or camera move |
|
match cut or whip pan camera transition |
|
fade, crossfade, track gain/volume, automation, duck/carve, audio effects, or one effect across several tracks |
|
picture and sound edits that combine cuts with camera motion or mixing |
|
lay out a project so it reads well in Studio: caption track, tracks per element kind, sub-compositions, safe zones |
|
source or generate media, or preprocess an unsupported mid-source freeze |
|
Constant data-playback-rate is render-safe for picture and pitch-preserved
sound. Speed ramps are a rate lane in data-automation.
For copyable edit contracts, load /hyperframes-core → references/creator-editing-recipes.md.
Broad feedback about how photographic media looks or behaves also routes to
/media-use, even when the user never says “color grading” or “effect”: fix
dark/flat/boring footage, stylize a clip, hide a face, or improve a media
reveal.
Do not substitute a generic LUT, CSS filter/overlay, or opacity tween for an
existing canonical treatment primitive. Keep text/layout/motion-only edits in
their owning domain.
During a build with important photographic media, include one grounded
media-polish scan in the final quality pass; leaving suitable media unchanged is
a valid result.
Domain skills never take ownership of the end-to-end deliverable. Load only what the active workflow needs.
Get started with chainctlchainctl skill install public/heygen-com/hyperframes:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/heygen-com/skills/hyperframes:latest
Apache-2.0
HARDENING.md
LICENSE
SKILL.md
references/brief-contract.md
references/brief-format.md
references/capability-menu.md
references/frame-worker-core.md
references/intent-interview.md
references/pitch-round.md
references/production-loop.md
references/review-loop.md
references/route-briefs.md
references/routes/embedded-captions.md
references/routes/faceless-explainer.md
references/routes/general-video.md
references/routes/motion-graphics.md
references/routes/music-to-video.md
references/routes/pr-to-video.md
references/routes/product-launch-video.md
references/routes/remotion-to-hyperframes.md
references/routes/slideshow.md
references/routes/talking-head-recut.md
references/script-format.md
references/skill-lifecycle.md
references/storyboard-format.md
references/subagent-dispatch.md
references/workflow-catalog.md
scripts/lib/frame-packets-core.mjs