Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/skillmds/skillmdnpx agentmods add skills/skillmds/skillmd/media-useWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/skillmds/skillmd/media-use)<a href="https://agentmods.dev/skills/skillmds/skillmd/media-use"><img src="https://agentmods.dev/badge/skills/skillmds/skillmd/media-use/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/skillmds/skillmd/media-use"><img src="https://agentmods.dev/badge/skills/skillmds/skillmd/media-use.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00149 | $0.07687 |
| Opus 5.5 | $0.00060 | $0.03075 |
| Sonnet 5.5 | $0.00030 | $0.01537 |
| Haiku 4.5 | $0.00015 | $0.00769 |
Grade C, and why
media-use scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -fsSL https://static.heygen.ai/cli/install.sh | bash Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -fsSL https://static.heygen.ai/cli/install.sh | bash How it starts
The opening of the file, as written. The whole thing — 456 lines — stays where its author put it; the contents beside it link to each section on GitHub.
media-use
The media OS for HyperFrames: resolve · generate · operate · remember, every media type, one skill, zero context noise.
Setup — install heygen first (free-usage path)
curl -fsSL https://static.heygen.ai/cli/install.sh | bash
heygen update # free usage needs the OAuth-capable CLI (v0.3.0+)
heygen auth login --oauth # OAuth = free subscription credits; --api-key bills API credits
This unlocks the FREE path for bgm/sfx/image/icon catalog search, TTS (voice), and avatar videos. Sign in with --oauth — the free allowance rides on the OAuth session (an API key bills API credits instead). media-use requires heygen >= v0.3.0 uniformly (the OAuth free-usage path needs it), so --doctor nudges older CLIs to update even for API-key-only use. Before resolving anything, verify setup with:
node <SKILL_DIR>/scripts/resolve.mjs --doctor
What it owns (the gaps HyperFrames leaves)
HyperFrames owns media playback; media-use owns everything else. Each row is enforced by scripts/lib/coverage.test.mjs so the claim can't rot.
| HyperFrames gap | media-use owns it via |
|---|---|
| Audio-only, no image/icon | resolve --type image|icon (heygen asset search) |
| No third-party brand logos | resolve --type logo (svgl → simple-icons → GitHub org avatar → domain favicon) |
| No voice / audio generation | resolve --type voice (HeyGen TTS free-usage path; optional local Kokoro) + the audio engine (audio/scripts/audio.mjs) |
| Scattered/duplicated audio engine | one consolidated engine under audio/ (hyperframes-media retired) |
| No agent media-ops (cut/reframe/transform) | references/operations.md + resolve --from to register outputs |
| No transcript-driven cutting | scripts/transcript-cut.mjs compiles word-timestamp edits into cut lists |
| No auto-duck / publish loudness | scripts/audio-duck.mjs + references/operations.md loudnorm/sidechain recipes |
| No cross-project memory | global content-addressed cache + auto-promote (~/.media) |
| No color-grade authoring | resolve --type grade emits a paste-ready data-color-grading block; resolve --type lut freezes validated .cube files |
| No image generation | RAM-graded local mflux (FLUX) via scripts/lib/mflux-provider.mjs, codex image_gen upsell (scripts/lib/codex-provider.mjs) |
| No video generation | resolve --type video — HeyGen avatar video first (free-usage path, sign-in nudge on auth failure), local LTX fallback (videogen in scripts/lib/local-models.mjs); image-to-video, photo-avatar, dub/translate remain manual heygen CLI recipes (references/operations.md) |
| Weak local-model defaults | HeyGen free-usage path via the heygen CLI; local open-source tools only as opt-in alternatives (scripts/lib/local-run.mjs) |
What ships with it
60 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- audio/assets/sfx/CREDITS.md 1.2 KB
- audio/assets/sfx/manifest.json 3.6 KB
- audio/references/bgm.md 7.3 KB
- audio/references/captions/authoring.md 8.8 KB
- audio/references/captions/motion.md 5.5 KB
- audio/references/captions/transcript-handling.md 5.3 KB
- audio/references/remove-background.md 8.3 KB
- audio/references/requirements.md 4.2 KB
- audio/references/sfx.md 3.4 KB
- audio/references/transcribe.md 2.7 KB
- audio/references/tts-to-captions.md 1.2 KB
- audio/references/tts.md 7.2 KB
- audio/scripts/audio.mjs 13 KB runs code
- audio/scripts/audio.test.mjs 1.9 KB runs code
- audio/scripts/heygen-tts.mjs 4.2 KB runs code
- audio/scripts/lib/bgm.mjs 11 KB runs code
- audio/scripts/lib/bgm.test.mjs 1.2 KB runs code
- audio/scripts/lib/concurrency.mjs 526 B runs code
- audio/scripts/lib/concurrency.test.mjs 1.6 KB runs code
- audio/scripts/lib/heygen.mjs 6.9 KB runs code
- audio/scripts/lib/heygen.test.mjs 3.5 KB runs code
- audio/scripts/lib/python.mjs 2.5 KB runs code
- audio/scripts/lib/python.test.mjs 2.6 KB runs code
- audio/scripts/lib/sfx.mjs 5.3 KB runs code
- audio/scripts/lib/sfx.test.mjs 2.8 KB runs code
- audio/scripts/lib/tts.mjs 16 KB runs code
- audio/scripts/lib/tts.spawn.test.mjs 5.1 KB runs code
- audio/scripts/lib/tts.test.mjs 6.0 KB runs code
- audio/scripts/lyria-recipe.py 4.4 KB runs code
- audio/scripts/wait-bgm.mjs 5.4 KB runs code
- luts/index.json 1.9 KB
- luts/README.md 1.1 KB
- references/operations.md 12 KB
- references/telemetry-dashboard.md 4.2 KB
- scripts/audio-duck.mjs 3.9 KB runs code
- scripts/eval.mjs 15 KB runs code
- scripts/lib/adopt.mjs 4.3 KB runs code
- scripts/lib/adopt.test.mjs 2.7 KB runs code
- scripts/lib/bgm-provider.mjs 649 B runs code
- scripts/lib/brand-provider.mjs 1.6 KB runs code
- scripts/lib/bundled-sfx-provider.mjs 3.5 KB runs code
- scripts/lib/bundled-sfx-provider.test.mjs 3.1 KB runs code
- scripts/lib/cache.mjs 4.8 KB runs code
- scripts/lib/candidates.mjs 4.0 KB runs code
- scripts/lib/candidates.test.mjs 5.9 KB runs code
- scripts/lib/codex-provider.mjs 5.9 KB runs code
- scripts/lib/coverage.test.mjs 5.6 KB runs code
- scripts/lib/cube-build.mjs 5.7 KB runs code
- scripts/lib/cube-build.test.mjs 2.7 KB runs code
- scripts/lib/cube-validate.mjs 5.9 KB runs code
- scripts/lib/cube-validate.test.mjs 3.2 KB runs code
- scripts/lib/cutlist.mjs 6.0 KB runs code
- scripts/lib/cutlist.test.mjs 4.0 KB runs code
- scripts/lib/duck.mjs 3.0 KB runs code
- scripts/lib/duck.test.mjs 3.4 KB runs code
- scripts/lib/freeze.mjs 3.0 KB runs code
- scripts/lib/freeze.test.mjs 1.9 KB runs code
- scripts/lib/grade-analyzer.mjs 5.2 KB runs code
- scripts/lib/grade-analyzer.test.mjs 4.7 KB runs code
- scripts/lib/heygen-cli.mjs 7.3 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 456 lines · 149 tokens per session scan C 1f5f8ab0839f
media-use is a skill published in the GitHub repository skillmds/skillmd (143 stars, last pushed 4d ago), licensed MIT. It adds 149 tokens to every session and 7,687 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-19.
media-use compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| media-useskillmds/skillmd | Skill | 143 | 4d ago | MIT | C | 149 | Claude Code |
| sloplessberelevant-ai/slopless | Skill | 339 | 3d ago | MIT | A | 40 | Claude Code, Codex |
| suikonwiizo/suiko | Skill | 115 | yesterday | MIT | A | 192 | Codex |
| poly-lint-and-formatGoldziher/poly | Skill | 20 | today | MIT | A | 42 | Claude Code |
| poly-orchestratorGoldziher/poly | Skill | 20 | today | MIT | A | 43 | Claude Code |
| poly-mcpGoldziher/poly | Skill | 20 | today | MIT | A | 38 | Claude Code |
| poly-tiers-and-scopeGoldziher/poly | Skill | 20 | today | MIT | A | 60 | Claude Code |