hyperframes-shorts

SUSPICIOUS: the core video-building behavior is mostly aligned with the stated purpose, and the official HyperFrames dependency path appears coherent. The main risk is install and execution trust: this skill chains into many additional skills, including unrelated third-party GitHub publishers, creating a broad transitive trust surface for an agent that will also execute local commands and modify project files.

No clear evidence of intentional malware (no exec/persistence/exfiltration logic), but the script has meaningful supply-chain/build-output risks if assets/brand.json is attacker-influenced. Primary concerns are: (1) unescaped injection of brand-controlled strings into index.html via regex replacements (possible XSS/content injection), (2) copying an arbitrary local file path specified by brand.avatarPath into assets/avatar.png (local file inclusion within process permissions), and (3) downloading remote content based on brand.avatarUrl with unbounded buffering and only minimal redirect/HTTPS checks. Hardening should include escaping/sanitization for HTML context, path allowlisting for avatarPath, and limits/validation for remote downloads.