Security audit
Security checks for vulnerabilities and agentic risk
This is a broad Ace Data Cloud provider that is clearly aimed at paid cloud AI, search, and media generation, with no hidden local execution or credential theft found.
Install this only if you want a broad paid Ace Data Cloud provider. Use a scoped, revocable API key where possible, allowlist only the optional tools you need, and review billable generation or destructive remote operations before approving them. Prompts, search queries, and reference media URLs are sent to Ace Data Cloud for the requested operation.
The manifest description says the skill is for generating video, motion, lip sync, talking photo, and goods studio, but the file documents additional tools for video commerce, virtual try-on, apparel, voices, and elements. These are materially broader capabilities than the manifest summary claims, so the declared purpose does not fully match the documented behavior.
The manifest description says the skill is for generating audio, lyrics, and retrieving MP3/MP4, but the documented tool set also includes broader capabilities such as persona creation/deletion, custom models, projects, WAV/MIDI/timing retrieval, and voice creation. This scope mismatch can mislead operators and policy layers about what the skill can actually do, increasing the chance of unintended use of account-management or destructive operations without appropriate scrutiny.
The skill description is very broad and does not define when the skill should or should not be invoked, what user intent qualifies, or any guardrails around sensitive operations like model/voice creation. In an agent setting, vague invocation boundaries can cause accidental tool use, unnecessary billable API calls, or triggering creation actions without sufficiently explicit user intent.
No suspicious patterns detected.
