Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward VibeVideo API helper, but users should understand that prompts, image URLs, API-key-authenticated requests, and paid credits may be involved.
Install only if you intend to use VibeVideo and are comfortable sending prompts and referenced image URLs to that service with your API key. Check credit cost before generation when cost matters, avoid secrets or private URLs in prompts/options, and treat task cancellation as a real state-changing API action.
The skill description does not warn that user prompts, optional image URLs, and the bearer-authenticated request will be sent to an external third-party API. This can lead users to unknowingly transmit sensitive prompts or private image references off-platform, creating privacy and data-handling risk.
The skill documents generation operations that consume paid credits but does not clearly warn users before invoking potentially billable actions. This can cause unintended financial impact, especially because defaults are provided and the workflow encourages immediate generation followed by polling.
The skill intentionally sends user-provided prompts and possibly image URLs to an external API endpoint with an authorization header. In context this is expected functionality, but it is still a genuine data egress surface that becomes dangerous if users provide sensitive content or if the skill fails to disclose the transmission clearly.
Create an image generation task:
curl -s -X POST https://vibevideo.app/api/ai/generate \
-H "Authorization: Bearer $VIBEVIDEO_API_KEY" \
-H "Content-Type: application/json" \
-d '{
The manifest says the skill should be used to create images or videos, check generation status, list available models, or calculate credit costs. The documented operations also include deleting/canceling an existing task via the API, which is a state-changing capability not mentioned in the manifest description.
No suspicious patterns detected.