Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add sugarforever/01coder-agent-skills --skill producing-videogit clone --depth 1 https://github.com/sugarforever/01coder-agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sugarforever/01coder-agent-skills/producing-video)<a href="https://agentmods.dev/skills/sugarforever/01coder-agent-skills/producing-video"><img src="https://agentmods.dev/badge/skills/sugarforever/01coder-agent-skills/producing-video.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 7 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 24 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 27 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 55 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 93 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 94 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 95 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 107 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00175 | $0.03655 |
| Opus 5 | $0.00088 | $0.01827 |
| Sonnet 5 | $0.00035 | $0.00731 |
| Haiku 4.5 | $0.00017 | $0.00365 |
Grade A, and why
producing-video scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- `curl -sSL https://www.hyperframes.dev/design/<slug>.md` （站点是 JS 渲染，多半取不到正文）； How it starts
The opening of the file, as written. The whole thing — 161 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Producing-Video · 音频 + 字幕 → 成片
把"用户已经录好的口播音频 + SRT 字幕"做成一条画面跟着声音走的 MP4。用 HyperFrames（HTML 即视频）出片。
铁律：音频和 SRT 是唯一事实源。 画面的内容来自 SRT，画面的时间轴来自 SRT 的 cue 时间戳，音频作为一个 <audio> clip 直接挂进合成里、渲染时自动合流 —— 没有"先出视频再合音频"这一步。
分工（很重要）
| 谁 | 做什么 |
|---|---|
| 用户 | 写稿 → 录音/合成音频 → 生成 SRT → 把 audio.mp3 + audio.srt 交给你 |
| 本 skill（你） | 选 frame/品牌 → 按 SRT 搭 HyperFrames 合成 → 校对 → 渲染成片 |
用户不指望你生成配音（那是上游）。如果用户还没有音频、问的是"怎么配音"，那不是本 skill —— TTS / 声音克隆是另一条线（见下方"超出范围"）。
依赖检查（pre-flight）
npx hyperframes doctor # 需要 Node ≥ 22 · FFmpeg · Chrome
需要 hyperframes / hyperframes-cli 两个 skill 在场（编写合成 + 跑 CLI）。缺了就让用户 npx hyperframes skills 安装后重来。
确认用户给了两个文件：音频（mp3/wav/m4a）+ SRT。只给音频没给 SRT → 本 skill 需要 SRT 拿时间轴；可让用户补 SRT（很多录音工具/剪辑软件能导出），不要默认去跑 Whisper 转写（用户没给 SRT 往往是有意的，先问）。
工作流
Step 1 · 选 frame / 品牌
画面的风格 = 一个 frame.md / visual-style / 既有系列品牌。三种来源，按情况选：
- 延续系列品牌（推荐用于日更/系列）。如果这期属于一个已有系列（如"AI 早读"），去翻该系列的封面/历史成片，沿用同一套 token（颜色、字体、栅格、页眉页脚），让视频和封面一脉相承。
- HyperFrames frame.md 模板。用户可能直接点名，例如
creative-mode/biennale-yellow/cobalt-grid。取 token：curl -sSL https://www.hyperframes.dev/design/<slug>.md（站点是 JS 渲染，多半取不到正文）；- 更靠谱：在本机
open-design仓库里找design-templates/*<slug>*/template.json，里面有精确的palette/typography（hex + 字体名）。
- 8 个内置 visual-style（Swiss Pulse / Velvet Standard / Shadow Cut / Maximalist 等）。在
hyperframesskill 的visual-styles.md里，直接抄 YAML token。
字体一律本地 woff2（见 Gotcha "字体"）。中文必须配 Noto Sans SC（400/500/700/900 视用量）；英文 display 按 frame 选（Archivo Black / Manrope / Oswald…）；标签数字常用 JetBrains Mono。从 fontsource CDN 下到项目的 fonts/：
curl -sSL -o fonts/<name>.woff2 "https://cdn.jsdelivr.net/fontsource/fonts/<family>@latest/<subset>-<weight>-normal.woff2"
# 中文：subset 用 chinese-simplified；拉丁：latin
Step 2 · 起项目
cd <repo>/studio/videos # 仓库约定：成片放这里
npx hyperframes init <YYYYMMDD-slug> --example blank --non-interactive
cd <YYYYMMDD-slug> && mkdir -p fonts audio
cp <user-audio> audio/narration-full.mp3
cp <user-srt> audio/narration.srt
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 161 lines · 175 tokens per session scan A e981770c572d
producing-video is a skill published in the GitHub repository sugarforever/01coder-agent-skills (134 stars, last pushed 2mo ago), licensed MIT. It adds 175 tokens to every session and 3,655 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
webgl-holographic-foil
A self-contained WebGL2 hero: thin-film interference over a crushed-foil surface whose palette shifts with the viewing angle; move the cursor to tilt the film.
general-video
Author or edit a custom HyperFrames composition when no specialized workflow fits, or when BRIEF.md sets flow: companion. Use for longer or multi-scene pieces, brand and sizzle reels, montages, static loops, static title cards, footage remixes, and freeform builds. Use motion-graphics instead for a short unnarrated…
html-ppt-hermes-cyber-terminal
OpenDesign + BYOK: choosing and wiring your own model, hands-on — cost, quality, and the routing decision. Built as a decision-grade AI literacy deck for engineers, IT, applied-AI teams.
html-ppt-taste-brutalist
16:9 HTML deck in tactical-telemetry / CRT-terminal taste. Deactivated-CRT charcoal slides, white-phosphor monospace, hazard-red accent, scanline overlay, ASCII syntax, density over decoration. Distilled from Leonxlnx/taste-skill brutalist-skill (Tactical Telemetry mode).
diagnostic-stem-delivery
Audio production with diagnostic analysis, timecode parsing from documents, and verified export workflow.
chengfeng-check-updates
An environment manager for a video-editing system. It checks whether its skills and runtime—the software needed to run them—are installed and compatible.