Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Revid integration that sends a user’s video idea to Revid to create a short video.
Install only if you are comfortable sending the prompt, optional style notes, and video-generation settings to Revid using your Revid API key. Avoid putting private, regulated, or proprietary information into prompts unless your Revid account terms allow it.
The skill invokes external HTTP APIs and references runnable shell examples, but it does not declare an explicit tool scope such as allowed-tools or permissions. In an agent environment, missing scope boundaries can let the runtime grant broader capabilities than the skill actually needs, increasing the blast radius if the skill is misused or combined with prompt injection.
The skill directs the agent to send user-supplied prompt content to Revid, but it does not clearly warn that the prompt will be transmitted to a third-party external service for processing. Users may unknowingly provide sensitive, proprietary, or personal data, creating privacy and compliance risk when that data leaves the local environment.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
HERE="$(cd "$(dirname "$0")" && pwd)"
PAYLOAD=$(jq --arg p "$PROMPT" '.source.prompt=$p' "$HERE/honey-prompt.json")
PID=$(curl -fsS https://www.revid.ai/api/public/v3/render \
-H "Content-Type: application/json" -H "key: $REVID_API_KEY" \
-d "$PAYLOAD" | jq -r .pid)
echo "pid=$PID"
The example payload specifies "language": "en-US", which imposes a specific language/locale in natural-language content without offering opt-in or explaining that the skill is intentionally English-only. This can violate language/locale policy when users are not given a choice.
The config hard-codes the voice language to "en-US", which is a natural-language locale choice applied without any visible opt-in or explanation. Under the policy rules, forcing a specific language is a violation unless the skill offers a choice or clearly documents a justified locale constraint.