HyperFrames is an open-source framework that turns HTML, CSS, media, and timed animations into deterministic MP4 videos. It is used locally, by coding agents, and in hosted authoring workflows to create rendered videos from web-based designs. Its catalogue add-ons provide skills, agents, instructions, hooks, settings, and a plugin for agent-driven video production.
Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/heygen-com/hyperframesnpx agentmods add skills/heygen-com/hyperframes/motion-graphicsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/heygen-com/hyperframes/motion-graphics)<a href="https://agentmods.dev/skills/heygen-com/hyperframes/motion-graphics"><img src="https://agentmods.dev/badge/skills/heygen-com/hyperframes/motion-graphics/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/heygen-com/hyperframes/motion-graphics"><img src="https://agentmods.dev/badge/skills/heygen-com/hyperframes/motion-graphics.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket pass
- Snyk warn
- NVIDIA SkillSpector warn
SkillSpector: 10 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 14 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 67 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 87 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 122 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 127 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 128 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 129 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 139 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 145 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium Prompt Injection · line 45 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00139 | $0.03408 |
| Opus 5.5 | $0.00056 | $0.01363 |
| Sonnet 5.5 | $0.00028 | $0.00682 |
| Haiku 4.5 | $0.00014 | $0.00341 |
Grade A, and why
motion-graphics scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- motion-graphics — 98% identical, 24 lines differ
How it starts
The opening of the file, as written. The whole thing — 175 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Plugin installs: Before setup or freshness commands, follow plugin execution rules when this skill is inside a HyperFrames plugin. Standalone installs keep the update instructions below.
First, keep this skill fresh — confirm with the user before running:
npx hyperframes skills update motion-graphics. A fast no-op when everything is current; otherwise it refreshes this skill plus the core domain skills it depends on before you rely on them.
figma source: If the logo/asset/animation to build from comes from a figma.com URL, run
/figmafirst — asset export, brand tokens, and Motion→GSAP translation if the graphic is a Figma Motion import — then build from its output. Don't drive Figma via raw MCP tools directly: that skips SVG sanitization,.media/manifest.jsonlprovenance, and brand-tokenvar()binding, so a later brand change can't propagate without a full re-import.
motion-graphics — dispatch entry
The front door is
/hyperframes. This skill makes a short, design-led, unnarrated motion graphic (motion is the message; ~under 10s, no voice-over). Anything longer, narrated, or multi-scene — or any uncertainty → read/hyperframesfirst: the intent layer owns every route decision.
This workflow is autonomous by design — at most one clarifying question (agents/director.md), then build through verification without intermediate review. The intent layer (/hyperframes → references/intent-interview.md) routes here directly without run-shape questions; a storyboard and companion session add little to a piece this short. Rendering is still user-gated: after checks and proof snapshots pass, open the Studio preview and ask the canonical “render now, or what changes?” question from ../hyperframes/references/brief-contract.md. When a BRIEF.md exists, read it before the director's question.
A short design-led motion graphic. Asset-first: decide the asset strategy and source real material before designing the shot, then design the shot around what you have, then compose by reusing catalog capabilities. All artifacts go to PROJECT_DIR = videos/<project-name>/ (created in Step 0); all paths below are relative to it.
| Phase | Execution | Primary artifact | Detailed flow |
|---|---|---|---|
| init | Bash | hyperframes.json |
Step 0 |
| plan | subagent — decide search? + classify + asset strategy | shot-plan.json (draft: category, asset_needs queries, brief) |
agents/director.md (Part 1) |
| source ◇ | Bash — media-use resolve (skip if asset_needs is empty) |
assets/ + assets/index.md |
phases/source/guide.md |
| design | subagent — shot design around resolved assets | shot-plan.json (final: block(s) + layout + motion + positions) |
agents/director.md (Part 2) |
| build | subagent — reuse-first composition | compositions/index.html |
agents/builder.md |
| verify | Bash — lint, check, proof snapshots; repair on failure |
.hyperframes/artifacts/snapshots/<id>/contact-sheet.jpg |
Step 5 |
| approve | Open the preview; ask render or changes; wait for the answer | explicit render approval | Step 6 |
| render | Bash — hyperframes render (MP4, or --format webm/mov for overlay) |
renders/video.mp4 or transparent overlay |
Step 6 |
What ships with it
22 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- agents/builder.md 4.0 KB
- agents/director.md 5.9 KB
- agents/finalize.md 1.0 KB
- catalog-map.md 10 KB
- categories/asset-fusion/module.md 3.9 KB
- categories/charts/module.md 1.9 KB
- categories/kinetic-type/module.md 1.6 KB
- categories/logo-reveal/module.md 1.1 KB
- categories/lower-thirds/module.md 1.5 KB
- categories/maps/bake-basemap.mjs 14 KB runs code
- categories/maps/module.md 9.4 KB
- categories/news/module.md 5.3 KB
- categories/stat/module.md 1.3 KB
- categories/tweet/module.md 1015 B
- categories/webpage/module.md 2.5 KB
- grounding/locate.mjs 8.0 KB runs code
- grounding/PROTOCOL.md 3.0 KB
- phases/source/guide.md 1.9 KB
- references/builder-contract.md 2.8 KB
- references/motion-vocabulary.md 3.9 KB
- references/shot-plan-ir.md 2.6 KB
- samples/asset-fusion/_ref-circle-highlight.html 10 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed 0024b21e05ca
- 11d ago Changed · -6 lines df1879ec7971
- 12d ago Changed · +2 lines 721c60b4bbfd
- 18d ago Changed · +2 lines d2139f2b6e56
- 1mo ago Changed 08d8511423df
- 1mo ago First seen · 177 lines · 139 tokens per session scan A 4cec384fc754
motion-graphics is a skill published in the GitHub repository heygen-com/hyperframes (64,542 stars, last pushed today), licensed Apache-2.0. It adds 139 tokens to every session and 3,408 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
architecture-diagram
Create a professional, dark-themed software/system architecture diagram as a single self-contained HTML file with inline SVG. Use when asked to visualize system components, layers, services, or how parts of a codebase fit together.
motiscope-analyze
Analyze a screen recording of an animation to characterize its motion — timing, easing, transforms, and sequencing — so it can be recreated as web code. Use when the user drops or points at a video of an animation (.mp4/.mov/.webm/.mkv/.m4v/.avi/.gif) and says things like "I want this animation on my site", "recreate…
motiscope-rebuild-site
Rebuild a whole landing page / multi-section website from a screen recording that scrolls or walks through it. Use when the user has a recording of an ENTIRE page (not a single animation) and wants the full page recreated — layout, sections, copy, design system, and scroll animations. Orchestrates analyze (measured…
validate-motion
Browse MotionSpec motion primitives and draft or validate a MotionSpec JSON specification for web animation. Use for catalog questions, choosing an available primitive, or checking an existing spec. This workflow validates specifications; it does not compile, deploy or execute animation.
audit-motion
Check a public website's CSS animation and transitions with MotionSpec. Use when the user asks for a motion-accessibility check, reduced-motion support, or pause controls on a specific public URL. Reports static CSS findings and coverage; does not certify accessibility or test flashing.
motion
Author verified, reduced-motion-safe web animation with MotionSpec. Use when adding scroll, entrance, hover, or loop animation to a website or web app — instead of hand-writing GSAP or CSS keyframes, write a MotionSpec JSON spec, validate it, and compile deterministic code.