What is hyperframes-media?

A guide to producing audio and other media assets for HyperFrames compositions, including speech, background music, and sound effects.

Use it to create or retrieve narration, background music, and sound effects through supported providers, local generators, or the bundled sound library.

It brings different audio sources and generation methods into one workflow for use in a composition.

hyperframes-media — Skill for Claude Code and Codex by J-StaR-Films-St

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add J-StaR-Films-Studios/VibeCode-Protocol-Suite --skill hyperframes-media

Clone the repo

git clone --depth 1 https://github.com/J-StaR-Films-Studios/VibeCode-Protocol-Suite

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/j-star-films-studios/vibecode-protocol-suite/hyperframes-media/github.svg)](https://agentmods.dev/skills/j-star-films-studios/vibecode-protocol-suite/hyperframes-media)

Your own site

<a href="https://agentmods.dev/skills/j-star-films-studios/vibecode-protocol-suite/hyperframes-media"><img src="https://agentmods.dev/badge/skills/j-star-films-studios/vibecode-protocol-suite/hyperframes-media/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/j-star-films-studios/vibecode-protocol-suite/hyperframes-media"><img src="https://agentmods.dev/badge/skills/j-star-films-studios/vibecode-protocol-suite/hyperframes-media.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 131 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,622 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 9 findings, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

medium Rogue Agent · line 37
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
medium MCP Rug Pull · line 40
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 44
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 45
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 46
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 52
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 76
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 79
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 80
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00131	$0.02622
Opus 5	$0.00066	$0.01311
Sonnet 5	$0.00026	$0.00524
Haiku 4.5	$0.00013	$0.00262

Measured 7d ago against content hash 242721710522, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

hyperframes-media scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.

The scan reads SKILL.md. This mod also ships 12 executable files (scripts/audio.mjs, scripts/heygen-tts.mjs, scripts/lib/bgm.mjs, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

Copies of this mod

1 near-identical copy found in the catalogue:

hyperframes-media — 100% identical, 0 lines differ

assets/.agent/skills/hyperframes/hyperframes-media/SKILL.md · 98 lines

How it starts

The opening of the file, as written. The whole thing — 98 lines — stays where its author put it; the contents beside it link to each section on GitHub.

HyperFrames Media

Create the audio and media assets a composition needs — voiceover (TTS), background music + sound effects, transcription, captions, background removal — then consume and animate that data in HTML. For placing assets into compositions, see hyperframes-core.

The audio engine — one source for TTS · BGM · SFX

Workflows do NOT hand-roll audio or vendor a copy. There is one engine — scripts/audio.mjs — that takes a neutral audio_request.json and writes audio_meta.json (plus assets under assets/voice|bgm|sfx):

# <MEDIA_DIR> = this skill's directory
node <MEDIA_DIR>/scripts/audio.mjs --request ./audio_request.json --hyperframes . --out ./audio_meta.json

All three capabilities degrade on ONE switch — whether a HeyGen credential is present (resolved from $HEYGEN_API_KEY / $HYPERFRAMES_API_KEY / ~/.heygen, not the CLI):

Capability	HeyGen credential present	absent
TTS	HeyGen Starfish REST (native word timestamps)	→ ElevenLabs → Kokoro (chain `transcribe` for words)
BGM	HeyGen music retrieval	Lyria → MusicGen local generation (detached)
SFX	HeyGen sound-effects retrieval (min_score 0.4)	bundled 21-file library (`assets/sfx/`)

Request (audio_request.json): { provider?, lang?, speed?, lines: [{ id, text, sfx?: [names] }], bgm: { mode?, query?, prompt? } }. id joins each line back to the caller's model (a frame number, a scene id, …). bgm.mode = retrieve | generate | none; omit for auto (retrieve when credentialed, else generate). An explicit retrieve is strict — it skips rather than starting a detached generate (for callers with no wait-bgm step).
Output (audio_meta.json, id-keyed): { tts_provider, voice_id, bgm, bgm_pending, …, voices: [{ id, path, duration_s, words }], sfx: [{ id, name, file, source, offset_s, duration_s, volume }], total_duration_s }.
--only tts,bgm,sfx runs a subset and merges into an existing --out (e.g. TTS+BGM early, SFX once cues exist).
BGM generate is spawned detached (bgm_pending: true) — run scripts/wait-bgm.mjs before assembling.
scripts/heygen-tts.mjs is a single-shot CLI over the same code (one text → wav + words) for when you just need HeyGen TTS without a request file.

Read the full file on GitHub · 98 lines

Files

What ships with it

24 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

7d ago First seen · 98 lines · 131 tokens per session scan A 242721710522

Subscribe to this mod's changes

hyperframes-media is a skill published in the GitHub repository J-StaR-Films-Studios/VibeCode-Protocol-Suite (24 stars, last pushed today), licensed ISC. It adds 131 tokens to every session and 2,622 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Creative and media ai ai-agents prompt-engineering

gpt-image-2-style-library

Choose GPT-Image2 / gpt-image-2 visual styles and industrial prompt templates from the awesome-gpt-image-2 style library. Use when an agent needs to create, rewrite, classify, or improve image-generation prompts with repository-backed templates, categories, style tags, scene tags, pitfalls, and example cases.

freestylefly/awesome-gpt-image-2 · 72 tokens

seedance-prompt

This skill should be used when the user asks to write, improve, translate, compress, or debug a Seedance 2.0 video prompt; mentions T2V, I2V, V2V, R2V, camera direction, prompt quality, or provides reference assets for a production-ready prompt.

Emily2040/seedance-2.0 · 68 tokens

short-drama-storyboard

A workflow for turning a Chinese short-drama script and its visual facts into a shot-by-shot storyboard with frozen starting-frame prompts.

zenstory-ai/drama-skills · 102 tokens

short-drama-video-prompts

A writing guide for turning approved short-drama storyboards and starting images into copy-ready prompts for generating video scenes. It covers both image-to-video prompts, which use a reference image, and text-to-video prompts, which describe the scene in words.

zenstory-ai/drama-skills · 106 tokens

short-drama-develop

A Chinese-language writing workflow for turning novel, short-drama, or comic-drama ideas and source material into an adaptation plan, story direction, creative brief, story engine, and episode map.

zenstory-ai/drama-skills · 195 tokens

short-drama-write

A writing workflow for creating or revising a shootable Chinese short-drama or animated-drama episode in Markdown.

zenstory-ai/drama-skills · 108 tokens