Security audit
Security checks for vulnerabilities and agentic risk
The skill warrants review because it redirects storyboard preparation into cloud image generation, although each image requires user confirmation.
If you only need storyboard preparation, request a preparation-only version before installing. For generation, explicitly approve the provider, submitted content, and possible charges. Verify the intended CLI version; its executable package and credential-file protections were not verified in this review.
The supplied code contains only an authentication-configuration command and performs no storyboard retrieval. Authentication could support a broader storyboard workflow, but the supplied chunk implements credential setup instead of the declared operation.
The supplied chunk only sets authentication credentials. Although authentication can support storyboard retrieval, no retrieval operation is present, so the chunk's demonstrated purpose materially differs from the declared purpose. There is no evidence of credential exfiltration.
The only supplied command performs login rather than storyboard retrieval. Although authentication could support a larger pipeline, the supplied chunk provides no connection to storyboard access and implements a materially different operation.
The supplied code performs only a login operation and shows no storyboard-related behavior. Authentication could support a larger workflow, but this chunk does not establish that connection and its sole visible purpose differs from the declared purpose.
The mandatory terminal-based image-generation workflow expands a storyboard-to-canvas preparation task into live external API execution, potentially transmitting storyboard content and consuming paid credits. Per-image user confirmation and disclosure of the service endpoints reduce the risk, but the unconditional execution requirement still redirects preparation-only requests into an unnecessary generation workflow.
These instructions require live CLI image generation even though the core workflow prepares a storyboard pipeline for a canvas. This scope expansion can lead to unnecessary external disclosure of prompts and paid API usage; explicit confirmation before each image mitigates, but does not eliminate, the workflow redirection risk.
