music-to-video

An agent skill by heygen-com, from heygen-com/hyperframes. Tags: audio, automation, generative, video.

What it does

Turn a music track (an audio file, a video to pull audio from, or a track generated from a mood brief) into a beat-synced video — lyric video, slideshow, or kinetic promo. The music drives all pacing; any user-supplied images/videos are cut onto the same beat grid, and a complete video needs zero assets. Narrated pieces → the input-matched workflow (see /hyperframes). Unclear → /hyperframes.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add heygen-com/hyperframes --skill music-to-video

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/heygen-com/hyperframes
cp -r hyperframes/skills/music-to-video ~/.claude/skills/music-to-video

Safety box score

Grade D, elevated risk: 51 of 100 risk points, rated 2026-10-13. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill turns local music and optional user media into a beat-synced video by running `npx` CLIs, Python analysis, per-frame build scripts, and a final render. The main risks are command execution, networked package/registry/provider calls, environment changes from installs/skill updates, and some unreadable/minified dependencies.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It runs multiple shell commands and scripts, including `npx hyperframes init ...`, `python3 <SKILL_DIR>/scripts/analyze-beatgrid.py`, `node <SKILL_DIR>/scripts/assemble-index.mjs`, and `npx hyperframes render .`.
Network access	2 (moderate)	It reaches out to remote services via `npx hyperframes skills update music-to-video`, `npx hyperframes catalog --query ... --json`, and provider/auth flows such as `npx hyperframes auth status` and `/media-use`.
Filesystem reach	2 (moderate)	It writes a project tree under `videos/<project>/`, stages media into `assets/bgm.mp3`, writes `BRIEF.md`, and `init` may update the installed skills set outside the repo.
Secrets & credentials	1 (low)	It touches authenticated-provider state with `npx hyperframes auth status` and warns `Never write keys into a per-repo .env`, but it does not ask the user to paste secrets directly.
Privilege & persistence	2 (moderate)	It installs Python packages with `python3 -m pip install librosa numpy soundfile` and can update the global skill set, which changes the local environment beyond the project.
Instruction hijack surface	0 (none)	I did not find prompt-injection text like instructions to ignore higher-priority rules or fetch hidden remote content; the workflow instructions are operational, not adversarial.
Irreversible actions	2 (moderate)	It explicitly allows the agent to proceed in autonomous mode through checkpoints: `post the Step 3 summary as a heads-up and proceed` and then render after approval checks.
Transparency	2 (moderate)	Several referenced files were not readable due size/budget, and `references/motion-primitives/assets/gsap.min.js` is a minified dependency, so a reviewer cannot fully inspect all shipped code.

Before installing

Run `npx hyperframes skills update music-to-video` in a scratch project first and confirm it only touches expected files.
Verify `python3 -m pip install librosa numpy soundfile` will go into a virtualenv, not system Python.
Check whether `npx hyperframes auth status` and the provider steps use any already-logged-in accounts you care about.
If you need a full audit, inspect the unread catalogs and `references/motion-primitives/assets/gsap.min.js` before trusting the bundle.

Rated 2026-10-13 by an automated review of 84 files from the skill's repository.

Source

Repository: heygen-com/hyperframes (all skills from this repository)
Path: skills/music-to-video/SKILL.md
Branch: main
Updated: 2026-09-19

changelog-video — Turn a weekly changelog .md into a finished branded changelog video (square 1080, ~45-60s, Annie VO, animated brand background, mock-UI visualizations.
general-video — Author or edit a custom HyperFrames composition when no specialized workflow fits, or when BRIEF.md sets flow: companion. Use for longer or multi-scene pieces.
pr-to-video — Turn a GitHub pull request (a PR URL, owner/repo#N, or 'this PR' in a checked-out repo) into a code-change explainer video — changelog, feature reveal, fix.
product-launch-video — Turn a product or marketing URL, pasted script, or brief into a product launch / promo video — SaaS promos, feature reveals, product demos.
auto-editor — Record a microphone or edit video/audio with the auto-editor CLI — cut out dead space (silence, motionlessness, black frames), set the pace, make manual cuts.
auto-editor-effects — Apply actions and animations to sections of a video/audio with auto-editor — change speed, duck or fade volume, de-ess, zoom/Ken Burns, rotate/spin.