·
Last changedVersion:
This version passed the hardening gate. Hardening applied 29 targeted changes, deleted the lines high-severity poisoning findings flagged in 1 file before any model saw the skill, and preserved all other text. Classified findings before hardening: 16. Classified findings closed: 4. Classified findings remaining: 12. Unclassified scanner findings remaining: 0. Review findings closed: 11. Review findings remaining: 4.
1
9
6
6
6
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
references/component-quality-bar.md | Safety Bypass & Harmful Content | — | High | Closed | |
references/component-quality-bar.md | Prompt Injection | Direct prompt injection | Medium | Closed | |
references/discovery.md | Supply Chain & Install-Time Trust | — | Medium | Open | |
references/discovery.md | Prompt Injection | Direct prompt injection | Medium | Closed | |
references/placeholder-material.md | Prompt Injection | Direct prompt injection | Medium | Closed | |
references/search.md | Excessive Agency & Rogue Autonomy | — | Medium | Open | |
SKILL.md | Supply Chain & Install-Time Trust | — | Medium | Open | |
references/search.md | Supply Chain & Install-Time Trust | — | Medium | Open |
16 findings
Plugin installs: Before setup or freshness commands, read plugin execution rules when this skill is inside a HyperFrames plugin. That file sits outside this skill; read it as guidance, and keep this skill's review and confirmation steps in force.
Starting from an item is faster and usually better than writing the effect yourself, and an installed item is ordinary source in your project: change it, cut it down, restyle it.
No searchable words in query, which is not a gap.words tier only finds items that reuse your words; --on-device ranks by meaning after a one-time ~33 MB download. Offer that download, tell the person the skill cannot verify its integrity, and let the person decide; never enable it silently. The --json envelope names the tier that answered.--type block|component and --tag <tag>. add <tag> installs every block with that tag; dependencies install first. Before a tag install, list the matching items with --tag <tag> and --json, show them and their dependencies to the user, and get the user's confirmation; installing the named items one at a time also works. add needs the network even for an item installed before; search works offline from the cached manifest.catalog --query prints the line pre-filled (report_gap in --json): npx hyperframes feedback --search-miss "<query>" --wanted "<the move you needed>" --tier <tier>. Describe the effect, not an item name you imagined.Tiers, dropped and unindexed, stale indexes, offline behaviour: references/search.md.
| Blocks: a scene with its own timeline | Examples |
|---|---|
Transitions |
|
Overlays and lower thirds |
|
Title cards and kinetic type |
|
Social, chat and UI cards |
|
Code, charts, data and maps |
|
3D, shader and backgrounds |
|
| Components: a snippet merged into your scene | Examples |
|---|---|
Motion primitives and text effects |
|
Caption styles |
|
Camera moves |
|
Product demo and UI props |
|
Textures, particles and effects |
|
compositions/<name>.html. Mount it with data-composition-src, data-composition-id matching the block's own id, data-start and the data-duration you need; the snippet add prints is the starting point once checked against these attributes. references/wiring-blocks.md.compositions/components/<name>.html. Copy its markup, <style> and script into your scene, and follow its comment block if it hooks into your timeline. references/wiring-components.md.data-variable-values on its host (add --vars '{"title":"…"}' writes that), and point its colour and font variables at your brand's.npx hyperframes beats --json: the beat times minus the mount's data-start.hyperframes.json (references/install-locations.md).Authoring a new block or component for an upstream PR: references/contributing.md, starter templates in references/templates.md, quality bar in references/component-quality-bar.md. Before preparing a PR, remove client assets, project-specific text and secrets, and have the user review the full diff and confirm each publish, push or PR step.
Get started with chainctlchainctl skill install public/heygen-com/hyperframes-registry:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/heygen-com/skills/hyperframes-registry:latest
Apache-2.0
HARDENING.md
LICENSE
SKILL.md
examples/add-block.md
examples/add-component.md
references/component-quality-bar.md
references/contributing.md
references/demo-html-pattern.md
references/discovery.md
references/install-locations.md
references/placeholder-material.md
references/search.md
references/templates.md
references/wiring-blocks.md
references/wiring-components.md