{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "hyperframes-cli",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "execute_command",
    "external_write",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "scripts/",
      "summary": "Local script or command execution: The skill directory contains NO internal scripts (all 11 files are markdown: SKILL.md + 10 reference files); documented commands refer to the hyperframes CLI binary."
    },
    {
      "file": "外部 API",
      "summary": "Posting, creating, or modifying resources on external platforms."
    },
    {
      "file": "环境变量 / API Key",
      "summary": "Reading vendor service credentials: HeyGen credential resolution order (explicit in cloud.md): HEYGEN_API_KEY → HYPERFRAMES_API_KEY → ~/.heygen."
    },
    {
      "file": "本地工作目录",
      "summary": "File read/write and artifact output: Within projects: hyperframes.json, index.html, compositions/, renders/, snapshots/, beats/<au"
    }
  ],
  "verification": {
    "method": "第二遍独立重读 + 反查：① 全量文件清单核对（含隐藏）= skills/hyperframes-cli/SKILL.md + references/ 下 10 份 md 共 11 个，与 skills-manifest.json 的 files=11 一致，目录内**零可执行文件**；② token 扫描逐条打开核对：URL 命中集中在 cloud.md（api.heygen.com、heygen-cli 仓链）、init-and-scaffold.md（capture 示例站 stripe.com/linear.app/example.com）、preview-render.md（localhost:3017 预览地址）、SKILL.md（hyperframes.heygen.com 的 catalog 搜索文档页）；process.env 命中 HEYGEN_API_KEY / HYPERFRAMES_API_KEY / HYPERFRAMES_NO_TELEMETRY / HYPERFRAMES_SKIP_SKILLS / AWS_PROFILE / AWS_REGION 等；③ 逐条回查 external_deps 的命令与端点是否在文中真实出现；④ 核对「声明 vs 能力」：本 skill 不含代码，全部能力经由官方 CLI 实现，故未发现夸大。",
    "second_pass": [
      {
        "item": "凭证读取是否真发生在该 skill 目录内（橙档判定关键）",
        "status": "ok",
        "detail": "目录内无任何代码（11 个文件全 md），故严格意义上「读取」由官方 CLI 执行；橙档依据是**声明面**：cloud.md 明写凭证解析顺序 HEYGEN_API_KEY → HYPERFRAMES_API_KEY → ~/.heygen/credentials，SKILL.md 又把 auth/cloud/lambda/cloudrun/publish/feedback 列为本 skill 统领的命令。与同批 hyperframes-cli 之外的 figma（FIGMA_TOKEN）保持同一口径，并在 reason 里注明执行主体。"
      },
      {
        "item": "SKILL.md 里的 hyperframes.heygen.com 链接是不是被当作端点调用",
        "status": "ok",
        "detail": "该 URL 出自「Search the catalog before writing motion by hand」段落，是 catalog 搜索的**说明页引用**（句末带句点，形如文档链接），不是命令参数；同段明确写搜索本身 entirely local、查询文本 never sent anywhere。故按范式归为文档引用，不计入外发面。"
      },
      {
        "item": "云上传是否真是「用户素材出网 + 消耗额度」，且是否有幂等风险提示",
        "status": "ok",
        "detail": "cloud.md 的渲染流水线写明 zip → 直传 S3 → POST /v3/hyperframes/renders → 轮询 → 下载，并直说「you pay per credit」；同文另给安全重试条款：zip 上传非幂等，盲重试会重复计费，故须 --idempotency-key。声明与风险提示齐备，未夸大。"
      },
      {
        "item": "feedback / telemetry 的隐私表述是否有反例",
        "status": "ok",
        "detail": "preview-render.md 有专门的脱敏段落（剥离绝对路径、机器标识、密钥，保留 HF_*/PRODUCER_* 变量原名），并给 COMPOSITION_STRUCTURE 的「无路径/无 src URL/无用户文本」定义；upgrade-info-misc.md 说明 telemetry 指纹只做存在性探测、从不读环境变量取值，且提供 telemetry disable 与 HYPERFRAMES_NO_TELEMETRY。未发现与声明矛盾之处。"
      },
      {
        "item": "是否漏网的高危行为（关沙箱/TLS 降级/绕过检测）",
        "status": "unlocatable",
        "detail": "对 keywords（sandbox / danger / no-verify / AutomationControlled / NODE_TLS / rejectUnauthorized）做全目录扫描均无命中；但本 skill 不含代码，真实执行细节在 packages/cli 内、不属于本 skill 目录，故只能声明「本目录未出现」，不能替 CLI 整体背书。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "d2f0bc7f34837da54ae22063772d75d75ce26477",
    "sha256": "9d841064257cece264bc5a49d0b73307e8ec1c6baf22fa9b9a0e4df3d419de6f",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-28/hyperframes-cli.tar.gz",
    "sha256": "9d841064257cece264bc5a49d0b73307e8ec1c6baf22fa9b9a0e4df3d419de6f",
    "commit": "d2f0bc7f34837da54ae22063772d75d75ce26477"
  },
  "original": {
    "github": "https://github.com/heygen-com/hyperframes/tree/main/skills/hyperframes-cli",
    "path": "skills/hyperframes-cli",
    "commit": "d2f0bc7f34837da54ae22063772d75d75ce26477"
  }
}