The skill executes unverified remote scripts via insecure shell piping and performs unauthorized network operations, creating a critical risk of arbitrary code execution and persistent system compromise.
Skill Info
Install
npx skills add https://github.com/heygen-com/hyperframesAssessments (3)
AI Agent Traps ↗Remote code download and execution detected
curl -fsSL https://static.heygen.ai/cli/install.sh | bash
A remote resource is downloaded with curl/wget and piped directly into a shell interpreter (optionally via sudo). The downloaded script runs with no integrity check (no checksum/signature), so a compromised server, MITM, or hijacked URL leads to arbitrary code execution. Download to a file, verify it (e.g. sha256sum -c against a pinned digest, or a signature), then execute it.
curl -fsSL https://static.heygen.ai/cli/install.sh | bash
The skill instructs users to pipe a remote install script directly into bash with no version pin, checksum, or signature verification. Beyond the already-flagged curl-pipe-shell pattern, the semantic intent here is to install a 'single static binary' from a domain controlled by the skill author, which then handles API keys and media downloads — creating a persistent privileged binary on the user's system. [ensemble: confirmed by 3/3 passes; severity set to the agreed median (ADR-0067).]
curl -fsSL https://static.heygen.ai/cli/install.sh | bash # installs latest to ~/.local/bin
Skill does not specify a license field. Specifying a license helps users understand usage terms.
Badge
[](https://mondoo.com/ai-agent-security/skills/github/heygen-com/hyperframes/media-use)<a href="https://mondoo.com/ai-agent-security/skills/github/heygen-com/hyperframes/media-use"><img src="https://mondoo.com/ai-agent-security/api/badge/github/heygen-com/hyperframes/media-use.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/heygen-com/hyperframes/media-use.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet, discover and control Shadow AI usage.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow