Claude Code, Skill
Hyperframes Community Skills
A community-maintained collection of focused, one-off skills for HyperFrames.
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit ba7a0bb6d356, unchanged since the check below.
SECRETS_PATH_CREDENTIAL
Why this grade
- SECRETS_PATH_CREDENTIAL Medium
Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).
.github/scripts/validate-skills.sh, line 83
-name 'id_rsa' -o -iname '*.key' -o -iname '*.p12' -o \
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
skills/camera-3d-captions/scripts/hand/build-sprites.py, line 37
r = subprocess.run(['node', 'render-anim.mjs', sk, out, '--size', '%dx%d' % (W, H), '--spf', str(spec.get('spf', 2)),
skills/camera-3d-captions/scripts/hand/build-sprites.py, line 45
shutil.rmtree(fdir, ignore_errors=True)
skills/day-in-my-life/scripts/qc.py, line 20
raw = subprocess.run(['ffmpeg', '-v', 'error', '-i', mp4, '-vf', f'scale={W}:{H},format=gray', '-f', 'rawvideo', '-'], capture_output=True).stdout
Show more
skills/day-in-my-life/scripts/qc.py, line 43
au = np.frombuffer(subprocess.run(['ffmpeg', '-v', 'error', '-i', mp4, '-ac', '1', '-ar', '48000', '-f', 'f32le', '-'], capture_output=True).stdout, np.float32)
skills/day-in-my-life/scripts/qc.py, line 50
r = subprocess.run(['ffmpeg', '-hide_banner', '-i', mp4, '-af', 'loudnorm=print_format=json', '-f', 'null', '-'], capture_output=True, text=True)
skills/day-in-my-life/scripts/score.py, line 389
subprocess.run(['ffmpeg', '-v', 'error', '-y', '-i', src, '-af', 'acompressor=threshold=-24dB:ratio=2:attack=30:release=300', tmp], check=True)
skills/day-in-my-life/scripts/score.py, line 391
r = subprocess.run(['ffmpeg', '-hide_banner', '-i', f, '-af', 'loudnorm=I=-17:TP=-1.5:LRA=11:print_format=json', '-f', 'null', '-'], capture_output=True, text=True)
skills/day-in-my-life/scripts/score.py, line 396
subprocess.run(['ffmpeg', '-v', 'error', '-y', '-i', tmp, '-af', af, '-ar', str(FS), '-c:a', 'pcm_s24le', dst], check=True)
skills/day-in-my-life/scripts/score.py, line 397
os.remove(tmp)
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address. can reach pbs.twimg.com. The description does not name that host. can reach api.fxtwitter.com. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
skills/vox-explainer/scripts/seam-gate.mjs, line 59
try { const r = await fetch(url, { signal: AbortSignal.timeout(2000) }); return r.ok; } catch { return false; }
skills/vox-explainer/scripts/seam-gate.mjs, line 112
const r = await fetch(base + "/api/projects");
skills/vox-explainer/scripts/seam-gate.mjs, line 173
const ws = new WebSocket(url);
Show more
skills/x-posting-license/references/profile-data.md, line 18
curl -sL "https://pbs.twimg.com/profile_images/<id>/<file>_400x400.jpg" -o avatar.jpg
skills/x-posting-license/references/profile-data.md, line 26
curl -s "https://api.fxtwitter.com/<handle>"
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.github/scripts/validate-skills.sh, line 82
-name '.env' -o -name 'id_dsa' -o -name 'id_ed25519' -o \
.github/scripts/validate-skills.sh, line 83
-name 'id_rsa' -o -iname '*.key' -o -iname '*.p12' -o \
.gitignore, line 1
# Secrets and local environment
Show more
.gitignore, line 2
.env
.gitignore, line 4
!.env.example
.gitignore, line 5
!.env.*.example
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit ba7a0bb6d356. can delete files. can reach a host that is not written as a fixed address. can reach pbs.twimg.com. The description does not name that host. can reach api.fxtwitter.com. The description does not name that host. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: ba7a0bb6d3567d124c51f6074625043bfe0b32eb
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.