Security audit
Security checks for vulnerabilities and agentic risk
This skill coherently provides AdsTurbo video-generation commands, with expected API use and media uploads, but users should treat uploaded media URLs as public.
Before installing, understand that the skill sends prompts and selected media to AdsTurbo using your ADSTURBO_API_KEY and may create publicly accessible URLs for uploaded images, audio, or video. Do not upload confidential or sensitive media unless you are comfortable with that exposure and AdsTurbo's retention and access behavior.
The invocation guidance includes the phrase "generate a video," which is broad natural language that can overlap with many everyday requests and lacks constraints on when this skill should be selected versus other video-related skills. Although some examples are specific, the trigger list does not provide negative examples or tighter scoping to reduce accidental invocation.
The Chinese trigger examples include "生成一段视频," which is a generic phrase for creating a video and may match many ordinary user requests beyond this skill's intended boundaries. The section does not include negative examples or explicit constraints to distinguish this skill from adjacent video tools.
The instructions tell users to upload local files so they become publicly accessible URLs, but they do not explicitly warn that this may expose sensitive photos, audio, or videos to anyone with the link or to broader public access depending on backend behavior. In a skill centered on handling user-provided media, omission of this privacy warning can lead users to disclose confidential or personal content unintentionally.
The Chinese-language section repeats the same upload workflow without clearly warning that local files become publicly accessible after upload. Because this section directly guides users to upload photos, voice samples, and videos, the missing disclosure creates a real risk of accidental exposure of personal or proprietary media.
The documentation explicitly instructs users to upload local images and videos to publicly accessible URLs before using the video-generation workflow, but it provides no warning about privacy, confidentiality, or access-control implications. This can lead users to unintentionally expose sensitive media, personal data, or proprietary assets to anyone with the URL or to third-party hosting services.
This code uploads a user-specified local file to remote storage via client.upload(...), which is a network operation that can transmit potentially sensitive local data. Although the module docstring explains the purpose, there is no confirmation prompt, visible user-facing notice, or explicit warning about sending local file contents to a remote endpoint in these command handlers or parser help text.
The file includes English headings but the concrete example prompts are written in Chinese, and the second half duplicates the guide in Chinese. There is no explicit statement that users may choose their preferred language for prompts or interaction, creating a mild locale-policy concern.
The file includes a full bilingual section headed with Chinese and English, but does not explain whether Chinese is required, optional, or targeted to a specific locale. Under the policy rule, imposing a specific language or locale without user opt-in can be a natural-language policy concern.
The only content is a comment stating that the scripts use only the Python standard library. However, no actual script code is present here to verify or refute that statement, so there is no confident intent-versus-code contradiction in this file alone.
