Security audit
Security checks for vulnerabilities and agentic risk
This skill coherently uses Revid to turn a public product URL into a promo video, with no hidden persistence or unrelated local access found.
Install only if you are comfortable sending public product-page URLs and extracted product details to Revid using your REVID_API_KEY. Avoid private storefront, unpublished, customer-specific, or internal URLs unless you have confirmed they may be shared with that service; adjust language/voice defaults when needed.
The skill includes shell-based execution examples and operational steps but does not declare any tool restrictions or allowed tool scope. In agent environments, that mismatch can lead to over-broad execution capability, making it easier for an agent to invoke shell/network actions without explicit least-privilege boundaries.
The skill tells the agent to send a user-supplied product URL to Revid for scraping and video generation, but it does not clearly warn the user that the external service will receive the URL and extracted page contents. This creates a transparency and data-handling risk, especially if users provide non-public, sensitive, or internal storefront links by mistake.
The skill's sample payload fixes the voice language to en-US, which can force a specific language/locale outcome. The file does not mention that users may choose another language or that English is an optional default, so it violates the language/locale choice policy.
The example performs an external API call to www.revid.ai and includes the user-provided product URL in the request, causing data to leave the local trust boundary. In the context of an agent skill, this is security-relevant because it operationalizes transmission of user-supplied data and potentially scraped page contents to a third party.
URL="https://your-shop.myshopify.com/products/your-product"
curl -s https://www.revid.ai/api/public/v3/render \
-H "Content-Type: application/json" \
-H "key: $REVID_API_KEY" \
-d "$(jq --arg url "$URL" '.source.url=$url' \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
PAYLOAD="$(jq --arg url "$URL" '.source.url=$url' "$HERE/shopify-aeropods.json")"
echo "→ POST /render"
RESP=$(curl -fsS https://www.revid.ai/api/public/v3/render \
-H "Content-Type: application/json" \
-H "key: $REVID_API_KEY" \
-d "$PAYLOAD")
The manifest sets the voice language explicitly to "en-US", which is a natural-language locale restriction. There is no indication in this file that the user can opt into a different language or that the skill is intentionally limited to a specific region or compliance context.
No suspicious patterns detected.