Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add tryproduck/produck-skills --skill demo-studiogit clone --depth 1 https://github.com/tryproduck/produck-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tryproduck/produck-skills/demo-studio)<a href="https://agentmods.dev/skills/tryproduck/produck-skills/demo-studio"><img src="https://agentmods.dev/badge/skills/tryproduck/produck-skills/demo-studio/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tryproduck/produck-skills/demo-studio"><img src="https://agentmods.dev/badge/skills/tryproduck/produck-skills/demo-studio.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 57 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 58 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 111 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00323 | $0.02177 |
| Opus 5 | $0.00161 | $0.01089 |
| Sonnet 5 | $0.00065 | $0.00435 |
| Haiku 4.5 | $0.00032 | $0.00218 |
Grade A, and why
demo-studio scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 13d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 118 lines — stays where its author put it; the contents beside it link to each section on GitHub.
DemoStudio — the playbook
You are building a premium product-demo motion-graphics film: one seamless timeline of
full-screen scenes telling the USER'S story (pick an arc that fits their product, e.g. problem →
product → payoff, before → after, or many inputs → one output; do not default to a feedback-capture
loop), with camera moves between beats. The whole video is ONE self-contained HyperFrames composition
(index.html = HTML + CSS + GSAP) that renders to MP4, then a single SFX track is muxed on.
Start from the example: example/index.html is a compact, commented, working scaffold that
shows the whole architecture (paused timeline, 3 scenes, a camera push, a flood, an endcard). Read
it first, then grow it into the real thing scene by scene.
0. When to use / not use
- Use for animated product demos, launch/hype videos, feature stories, flywheel/loop narratives. Any "show the product doing something, beautifully, scene by scene" film.
- Not for: single-concept explainer reels (one scene per spoken beat), talking-head/CapCut edits, or avatar/TTS videos. Different tools entirely.
1. Architecture (always the same)
- One paused timeline:
const tl = gsap.timeline({paused:true}); register it onwindow.__timelines["main"] = tl. HyperFrames seeks it per frame. - Scenes = absolutely-positioned full-frame
<div>s inside#stage, overlapping in the DOM; faded in/out by the timeline. Only the active one is visible at a given time. - Schedule by ABSOLUTE time — the last arg of every
tl.*call is the start time in seconds. Anchor scene offsets with named consts (e.g.S1,S2,END) so changing one shifts the rest. ADURconst + thedata-durationattrs (root, bg, stage) must all match the total length. - Deterministic only: no
Math.random()/Date.now()/ arglessnew Date()— they break the frame-seeked render. Use a seeded PRNG (see themul()/rnd()helpers in the example). - Build loop:
npx hyperframes lint # 0 errors required npx hyperframes render --output out/raw.mp4 -q high ffmpeg -i out/raw.mp4 -c:v libx264 -pix_fmt yuv420p -g 30 -keyint_min 30 \ -sc_threshold 0 -r 30 -crf 17 -movflags +faststart out/vNN.mp4 # ALWAYS re-encode ffmpeg -ss <t> -i out/vNN.mp4 -frames:v 1 /tmp/f.png # verify by viewing frames - gsap defaults:
gsap.defaults({ease:"power3.out", duration:0.6}). RegisterMotionPathPluginif used.
What ships with it
38 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- docs/ARCHITECTURE.md 9.3 KB
- docs/BRANDING.md 3.2 KB
- docs/HOW-IT-WORKS.md 4.8 KB
- docs/SETUP.md 2.9 KB
- docs/SOUND.md 5.5 KB
- docs/TUTORIAL.md 6.8 KB
- example/hyperframes.json 264 B
- example/index.html 15 KB
- example/meta.json 61 B
- scripts/render.sh 1.7 KB runs code
- setup.sh 3.6 KB runs code
- sfx/boom.wav 73 KB
- sfx/capture.wav 29 KB
- sfx/click.wav 1.6 KB
- sfx/coin.wav 26 KB
- sfx/confirm.wav 29 KB
- sfx/ding.wav 28 KB
- sfx/dinghi.wav 24 KB
- sfx/drag.wav 36 KB
- sfx/implode.wav 53 KB
- sfx/notify.wav 26 KB
- sfx/pop.wav 6.5 KB
- sfx/pophard.wav 7.8 KB
- sfx/resolve.wav 95 KB
- sfx/riser.wav 121 KB
- sfx/success.wav 26 KB
- sfx/swish.wav 26 KB
- sfx/swishfast.wav 17 KB
- sfx/thump.wav 29 KB
- sfx/tick.wav 1.1 KB
- sfx/type.wav 103 KB
- sfx/unlock.wav 43 KB
- sfx/wash.wav 47 KB
- sfx/whoosh.wav 53 KB
- sfx/zoomin.wav 47 KB
- sfx/zoomout.wav 47 KB
- templates/build_audio_kit.py 3.8 KB runs code
- templates/make_kit.py 6.4 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 13d ago First seen · 118 lines · 323 tokens per session scan A 0a09e29b876c
demo-studio is a skill published in the GitHub repository tryproduck/produck-skills (511 stars, last pushed 29d ago), licensed Apache-2.0. It adds 323 tokens to every session and 2,177 once invoked, about $0.0016 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
resolve-pr-comments
Evaluate, fix, answer, and reply to GitHub pull request review comments and conversation comments. Handles both change requests (fix or skip) and reviewer questions (explain using reasoning recalled from past Claude Code transcripts). Use when the user asks to "resolve PR comments", "fix review comments", "address PR…
create-threat-model
Analyze a codebase and produce a structured threat model at .turbo/threat-model.md covering assets, trust boundaries, attack surfaces with existing mitigations, attacker stories, and calibrated severity. Use when the user asks to "create a threat model", "threat model", "threat model this codebase", "security…
update-dependencies
Upgrade project dependencies with breaking change research for major version updates. Use when the user asks to "update dependencies", "upgrade packages", "upgrade dependencies", "update deps", "upgrade deps", "update npm deps", "update Swift packages", "cargo update", "go get updates", "bundle update", or "pip…
map-codebase
Deep architecture report that fans out parallel inspections across different aspects of the codebase (structure, tech stack, APIs, patterns, data flow, dependencies, testing) and synthesizes findings into a comprehensive document at .turbo/codebase-map.md and .turbo/codebase-map.html. Use when the user asks to "map…
review-plan
Review a plan by running internal reviews and a peer review in parallel and returning combined findings. Use when the user asks to "review my plan", "check my plan", "critique my plan", or wants feedback on a plan.
changelog-rules
Shared changelog conventions and formatting rules referenced by /create-changelog and /update-changelog. Not typically invoked directly.