mirror of
https://github.com/heygen-com/hyperframes.git
synced 2026-09-03 23:03:09 +00:00
WaterrrForeverandClaude Opus 4.8
535297280a
* fix(skills): clear Snyk findings and harden supply-chain surface
Address the security-audit findings on the published skills with no change to
any skill's behaviour.
- media-use: resolve.test.mjs runs resolve.mjs via execFileSync with an argv
array instead of execSync(`node … "${tmp}" …`), removing the command-injection
(CWE-78) sink that drove the Snyk Fail.
- music-to-video: replace dynamic `element.innerHTML = <var>` with a setSvg()
helper (DOMParser image/svg+xml + importNode, text fallback) in the
intro-kinetic-cascade and logo-split-lockup-pulse frame templates, clearing the
DOM-XSS (CWE-79) Snyk Fail. Renders identical SVG.
- pr-to-video: fetch-people-avatars.mjs refuses any avatar URL that is not https
on a GitHub avatar host (SSRF guard) and only writes under the project dir
(path-traversal guard); best-effort, always-exit-0 behaviour is unchanged.
- embedded-captions: pin `uvx --from whisperx==3.8.6` (overridable via
$WHISPERX_VERSION) so transcription no longer resolves "latest" at runtime.
- gsap: add Subresource Integrity (integrity + crossorigin) to the 8 render-time
CDN GSAP <script> tags across embedded-captions, music-to-video,
faceless-explainer, pr-to-video and product-launch-video.
- hyperframes-animation / hyperframes-creative: document package-loader's
defense-in-depth and note that the installLine strings are display-only.
Verified: media-use resolve (12/12), probe injection (1/1) and manifest (19/19)
tests pass; avatar host-allowlist checks pass; all changed JS passes node --check
and oxfmt.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs(skills): clarify product-launch-video vs website-to-video routing
Sharpen the router's product-vs-site decision in hyperframes/SKILL.md: the
split is now "is the site selling a product?" — yes (SaaS / app / product /
company site) → /product-launch-video (a promo; the default for any commercial
URL, even if the site is only named); no, or the user just wants the site shown
as-is (portfolio / blog / docs / personal / event) → /website-to-video (a tour).
Updates the workflow table, the disambiguation bullet, and both workflows'
Input/Output blurbs to match.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* style(skills): satisfy oxfmt in the two music-to-video templates
The CI Format job runs `oxfmt --check .`, which also formats embedded <script> in .html. Reflow the setSvg() blocks added for the DOM-XSS fix to oxfmt's wrapping — no logic change. Regenerate the music-to-video manifest hash to match.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(skills): sanitize SVG in music-to-video templates (real CWE-79 fix)
Addresses @Magi's review: the previous setSvg() only swapped the sink
(innerHTML → DOMParser + importNode) but did NOT sanitize, so active SVG
content still executed on insertion into the live document. Verified in
headless Chrome that the old shape fired both an svg `onload` handler and an
inline `<script>`.
setSvg() now runs a default-deny cleanSvg() over the parsed tree before it ever
enters the document: only an allow-list of inert drawing elements
(svg/g/path/line/rect/circle/… ) and presentation attributes
(d/fill/stroke/viewBox/…) survives. Every other element (`<script>`, `<image>`,
`<use>`, `<foreignObject>`, `<a>`, `<animate>`, …), every `on*` handler, and
href/xlink:href/style are stripped — on the root node too. Non-SVG or malformed
input still falls back to textContent.
Trusted content (the bundled icon library + the default spark/cloud marks)
renders byte-identically; only hostile markup in vars.icon / leftMark / rightMark
is neutralized.
Browser-verified (headless Chrome, both templates' helper):
old setSvg → fired ["script","onload"]
new setSvg → fired [] · trusted icon still renders · 0 danger nodes · 0 on* attrs
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
82 lines
1.6 KiB
JSON
82 lines
1.6 KiB
JSON
{
|
|
"source": "heygen-com/hyperframes",
|
|
"skills": {
|
|
"embedded-captions": {
|
|
"hash": "62aec45830eda54b",
|
|
"files": 144
|
|
},
|
|
"faceless-explainer": {
|
|
"hash": "844c54a06fd16d3c",
|
|
"files": 17
|
|
},
|
|
"general-video": {
|
|
"hash": "a30225e30ec7b06c",
|
|
"files": 1
|
|
},
|
|
"hyperframes": {
|
|
"hash": "e0cf1bb2843bc834",
|
|
"files": 1
|
|
},
|
|
"hyperframes-animation": {
|
|
"hash": "3b592d54ca1d5b6e",
|
|
"files": 116
|
|
},
|
|
"hyperframes-cli": {
|
|
"hash": "9b36a367a0e3a332",
|
|
"files": 7
|
|
},
|
|
"hyperframes-core": {
|
|
"hash": "956d95de15d8c7fc",
|
|
"files": 13
|
|
},
|
|
"hyperframes-creative": {
|
|
"hash": "18a14a79da6cbc06",
|
|
"files": 68
|
|
},
|
|
"hyperframes-media": {
|
|
"hash": "096b2ab0a43b05dd",
|
|
"files": 40
|
|
},
|
|
"hyperframes-registry": {
|
|
"hash": "e3b389526834109d",
|
|
"files": 10
|
|
},
|
|
"media-use": {
|
|
"hash": "fba6e0963e431b1e",
|
|
"files": 19
|
|
},
|
|
"motion-graphics": {
|
|
"hash": "be1d1f159d5eb0e4",
|
|
"files": 23
|
|
},
|
|
"music-to-video": {
|
|
"hash": "0c5738fac0fe622f",
|
|
"files": 132
|
|
},
|
|
"pr-to-video": {
|
|
"hash": "132b44ddda774fef",
|
|
"files": 21
|
|
},
|
|
"product-launch-video": {
|
|
"hash": "32cab842cc7a6b76",
|
|
"files": 18
|
|
},
|
|
"remotion-to-hyperframes": {
|
|
"hash": "9d959b31fa0fc9d0",
|
|
"files": 70
|
|
},
|
|
"slideshow": {
|
|
"hash": "2f006c93745fcc32",
|
|
"files": 2
|
|
},
|
|
"talking-head-recut": {
|
|
"hash": "a3dc251f26be8a3e",
|
|
"files": 27
|
|
},
|
|
"website-to-video": {
|
|
"hash": "ac39931f9a7da749",
|
|
"files": 32
|
|
}
|
|
}
|
|
}
|