Skills Explorer Add Skills

pr-to-video

An agent skill by heygen-com, from heygen-com/hyperframes. Tags: automation, debugging, developer-tools, generative, video.

What it does

Turn a GitHub pull request (a PR URL, owner/repo#N, or 'this PR' in a checked-out repo) into a code-change explainer video — changelog, feature reveal, fix, or refactor walkthrough built from the diff, commits, and files: the input is a code change, not a website. Not a product promo (/product-launch-video) or a no-PR topic explainer (/faceless-explainer). Unclear → /hyperframes.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add heygen-com/hyperframes --skill pr-to-video

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/heygen-com/hyperframes
cp -r hyperframes/skills/pr-to-video ~/.claude/skills/pr-to-video

Safety box score

Grade D, elevated risk: 53 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill runs a full PR-to-video pipeline: it fetches PR metadata and diffs with `gh`, downloads contributor avatars, calls a remote audio engine, edits storyboard/frame files, and renders a final MP4 in a project directory. The main risks are networked data access, broad file writes/edits, authenticated GitHub/HeyGen access, and a few core pipeline files that were not readable in the supplied bundle.

Category levels, from 0 (none) to 3 (high)
CategoryLevelWhy
Code & shell execution2 (moderate)It orchestrates many shell and Node commands (`npx hyperframes init/add/auth status/render`, `gh pr view/diff`, `node .../audio.mjs`, `spawnSync("node", args, ...)`), so installing it grants a multi-step command runner.
Network access2 (moderate)It reaches out to GitHub for PR data and avatars and to HeyGen for audio retrieval; e.g. `gh pr view`, `fetch(avatarUrl)` in `scripts/fetch-people-avatars.mjs`, and the Step 3.1 audio flow uses HeyGen-backed voice/BGM retrieval.
Filesystem reach2 (moderate)It writes and rewrites many artifacts (`capture/pr.json`, `capture/diff.patch`, `STORYBOARD.md`, `compositions/frames/*.html`, `index.html`, `renders/video.mp4`) and defaults to a durable cache path under `~/.cache/hyperframes/...`.
Secrets & credentials2 (moderate)It depends on authenticated GitHub and HeyGen state (`gh auth status`, `npx hyperframes auth status`, and the audio flow references the same `~/.heygen` credential), so it can access accounts tied to those logins.
Privilege & persistence1 (low)There is no sudo/service install, but `npx hyperframes init` says it can update the global skills set and the workflow installs blocks with `npx hyperframes add`, which mutates installed CLI state.
Instruction hijack surface1 (low)The skill tells the agent to trust an external intent layer and, in autonomous mode, to proceed without asking (`"The brief is confirmed by the intent layer, not by questions asked here"`, `"there is nothing to ask — post the same summary as a heads-up and proceed"`).
Irreversible actions1 (low)It can carry a PR all the way to a rendered deliverable (`renders/video.mp4`), but it does not push, publish, or book anything externally; the gated review steps remain in the workflow.
Transparency2 (moderate)Several core files were not readable in the supplied bundle (`scripts/assemble-index.mjs`, `scripts/build-frame.mjs`, `scripts/captions.mjs`, `scripts/ingest.mjs`, plus `references/motion-language.md`, `references/story-design.md`, `references/visual-design.md`), so the full build/render behavior could not be audited.

Before installing

Rated 2026-10-20 by an automated review of 28 files from the skill's repository.

Source

Repository
heygen-com/hyperframes (all skills from this repository)
Path
skills/pr-to-video/SKILL.md
Branch
main
Updated
2026-09-19