hyperframes-cli

An agent skill by heygen-com, from heygen-com/hyperframes. Tags: automation, debugging, developer-tools, devops.

What it does

Use the HyperFrames CLI development loop: init, add, catalog, capture, lint, check, snapshot, compare, grade-compare, preview, play, present, beats, keyframes, single or batch render, publish, cloud, cloudrun, feedback, lambda, doctor, browser, info, upgrade, skills, compositions, timeline, docs, benchmark, telemetry, transcribe, auth, tts, and remove-background. Also use when diagnosing build or render failures. validate, inspect, and layout are deprecated aliases; use check. Covers local, HeyGen-hosted cloud, AWS Lambda, and Google Cloud Run rendering.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add heygen-com/hyperframes --skill hyperframes-cli

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/heygen-com/hyperframes
cp -r hyperframes/skills/hyperframes-cli ~/.claude/skills/hyperframes-cli

Safety box score

Grade F, high risk: 72 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

HyperFrames CLI is a local authoring and verification wrapper, but it also reaches into cloud rendering, publishing, and feedback flows. The main risks are off-machine data transfer, access to stored credentials, and commands that can deploy or tear down external resources or publish source publicly.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	The skill is built around running `npx hyperframes ...` commands, and even includes a detached shell example (`bash -c '... npx hyperframes render ... &'`) that executes CLI code and shell commands on the machine.
Network access	3 (high)	Several paths send data off-machine: `cloud render` "zips the project, uploads it ... and downloads the finished video," and the skill also includes publish/feedback flows that transmit project data to remote services.
Filesystem reach	2 (moderate)	It reads and writes outside the project tree, including `~/.heygen/credentials`, `~/.hyperframes/cloudrun-state.json`, and `<cwd>/.hyperframes/lambda-stack-<name>.json`, plus cache/history under `~/.hyperframes/`.
Secrets & credentials	3 (high)	The docs directly use and store credentials (`HEYGEN_API_KEY`, `HYPERFRAMES_API_KEY`, `HEYGEN_ACCESS_TOKEN`, `~/.heygen/credentials`, and AWS credentials in `~/.aws/credentials`), so the skill touches real account secrets.
Privilege & persistence	2 (moderate)	It instructs users to install or manage system tooling such as FFmpeg via `brew install ffmpeg` and to download/manage a pinned Chrome via `browser ensure`, which changes host-level software.
Instruction hijack surface	2 (moderate)	The skill normalizes bypassing confirmations and non-interactive operation (`--non-interactive`, `--yes`, `--no-wait`), so an agent can act without a human prompt if it follows the docs literally.
Irreversible actions	3 (high)	It can deploy and destroy external infrastructure (`lambda deploy`/`destroy`, `cloudrun deploy`/`destroy`) and publish source or renders, which are broad irreversible actions outside the local machine.
Transparency	0 (none)	All shipped files are readable markdown documentation; there are no binaries, hidden payloads, or decoded-at-runtime scripts in the skill bundle.

Before installing

Read `references/cloud.md`, `references/lambda.md`, and `references/cloudrun.md` first if you might use any cloud path; they upload data and can destroy cloud resources.
Check which credentials are present (`HEYGEN_API_KEY`, `HYPERFRAMES_API_KEY`, `~/.heygen/credentials`, `~/.aws/credentials`) and use a throwaway account if possible.
Decide whether you are okay with persistent state under `~/.hyperframes/` and `~/.heygen/` before running the skill.
If you only want local verification, avoid `cloud`, `lambda`, `cloudrun`, `publish`, and `feedback` commands entirely.

Rated 2026-10-16 by an automated review of 11 files from the skill's repository.

Source

Repository: heygen-com/hyperframes (all skills from this repository)
Path: skills/hyperframes-cli/SKILL.md
Branch: main
Updated: 2026-09-19

harness-engineering — This skill should be used when designing autonomous agent harnesses: research loops, evaluation scaffolds, locked and editable surfaces, durable logs.
obsidian-cli — Interact with Obsidian vaults using the Obsidian CLI to read, create, search, and manage notes, tasks, properties, and more.
agents-deploy — Use when deploying your agent to AWS, or when a deploy has failed.
code-improver — Runs an autonomous review-and-fix improvement loop over any code target — a skill, plugin, module, or directory — using a reviewer the user names.
devcontainer-setup — Creates devcontainers with Claude Code, language-specific tooling (Python/Node/Rust/Go), and persistent volumes.
pr-improver — Runs an autonomous review-and-fix improvement loop over the current branch's changes until a PR review comes back clean.