Skills Explorer Add Skills

media-use

An agent skill by heygen-com, from heygen-com/hyperframes. Tags: api, automation, generative, media.

What it does

Agent Media OS, the single skill for every media need in a HyperFrames project. Resolve BGM, SFX, image, icon, brand logo, voice, color grade, or LUT into a frozen local file or paste-ready block + ledger record (one verb, `resolve`); generate via TTS / music / image models when the catalog misses; produce voiceover, transcription, captions, and background removal through one shared audio engine; operate on media (cut / reframe / transform); and reuse assets across projects. Also use for vague feedback that real footage looks dark, flat, boring, should feel retro/camcorder/print/ASCII, needs privacy, or needs a media reveal.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add heygen-com/hyperframes --skill media-use

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/heygen-com/hyperframes
cp -r hyperframes/skills/media-use ~/.claude/skills/media-use

Safety box score

Grade D, elevated risk: 46 of 100 risk points, rated 2026-10-21. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

media-use is a media pipeline skill that resolves, generates, and transforms audio/image assets while writing results into the project and the user's home media caches. Its main risks are outbound uploads to HeyGen/Google/Openverse, secret-bearing auth via env vars and credential files, and remote account changes such as HeyGen voice cloning/deletion; some core engine files were not readable in this review.

Category levels, from 0 (none) to 3 (high)
CategoryLevelWhy
Code & shell execution2 (moderate)It regularly spawns other programs (`spawnSync(...)`, `execFileSync(...)`) and can invoke a registry package via `npx --yes hyperframes@${pluginVersion}` in `scripts/resolve.mjs`.
Network access2 (moderate)Inherent to the skill's purpose, it sends local media or prompts to third parties: HeyGen voice clone/TTS calls, Google Gemini TTS (`https://generativelanguage.googleapis.com/...`), and Openverse fetches.
Filesystem reach2 (moderate)It writes project artifacts and user-home state under `.media`, `~/.media`, `~/.cache/hyperframes`, and `~/.hyperframes/config.json` (`return join(mediaHome(), ".media");`).
Secrets & credentials2 (moderate)It reads API keys and credential files (`GEMINI_API_KEY`, `GOOGLE_API_KEY`, `GOOGLE_APPLICATION_CREDENTIALS`, `GCS_CREDS`, `~/.heygen/credentials`) and turns them into auth headers/tokens.
Privilege & persistence0 (none)No sudo, services, shell startup edits, global installs, or other OS-level privilege changes were visible in the reviewed files.
Instruction hijack surface0 (none)I did not find hidden instructions, prompt-skip rules, or fetched instruction chains in the visible files.
Irreversible actions2 (moderate)It can make remote state changes such as cloning and deleting HeyGen voices, and it automatically records generated media into manifests and user-memory files.
Transparency2 (moderate)Key engine files were not readable in this review (`audio/scripts/audio.mjs`, `audio/scripts/lib/tts.mjs`, `audio/scripts/lib/sfx.mjs`, `scripts/lib/manifest.mjs`), so some behavior is still unverified.

Before installing

Rated 2026-10-21 by an automated review of 61 files from the skill's repository.

Source

Repository
heygen-com/hyperframes (all skills from this repository)
Path
skills/media-use/SKILL.md
Branch
main
Updated
2026-09-19