Security audit
Security checks for vulnerabilities and agentic risk
This is a transparent Spanish-language workflow for generating and testing short-video hooks; its AI media generation, predictor use, and local report saving are disclosed and fit the purpose.
Install only if you are comfortable sending prompts, generated media, and possibly user-provided reference images to Higgsfield or Apify when those integrations are used. Confirm credit costs before generation, avoid using a person's face or private material without consent, and adjust the Spanish dialect requirement if your audience expects a different voice.
Referenced artifact was not completely inspected
> - La referencia a los criterios de `evaluador-ganchos-formula100k` apunta a una skill que no viene en este paquete: usa `criterios.md` de esta misma skill.
Referenced artifact was not completely inspected
> - La referencia a los criterios de `evaluador-ganchos-formula100k` apunta a una skill que no viene en este paquete: usa `criterios.md` de esta misma skill.
Referenced artifact was not completely inspected
> - La referencia a los criterios de `evaluador-ganchos-formula100k` apunta a una skill que no viene en este paquete: usa `criterios.md` de esta misma skill.
Referenced artifact was not completely inspected
- `output-template.md` — formato del reporte LAB con ranking y brief de ganadora
Referenced artifact was not completely inspected
- `output-template.md` — formato del reporte LAB con ranking y brief de ganadora
The trigger scope is overly broad because it activates on essentially any request that involves designing or proposing hooks. That can cause the agent to invoke this skill in contexts where the user did not explicitly want AI media generation, external plugin use, or this workflow, increasing the chance of unintended actions, unnecessary cost, or mishandling of user input.
Mandating a specific dialect ('Español neutro obligatorio') without user choice reduces user control and can override explicit preferences or accessibility needs. While not a classic security flaw, it is a policy/behavioral overreach that can cause the agent to ignore user instructions and degrade trust, especially for locale-sensitive or identity-sensitive communication.
This markdown file provides all operational instructions exclusively in Spanish and does not mention that the skill is Spanish-only or offer an opt-in language choice. Under the policy, forcing a specific language without user choice is a natural-language locale violation unless the restriction is clearly documented and justified.
Lines L011-L013 state that no family shows a defensible performance difference and that no molde outperforms another. However, L152-L153 says '¿Sabías que...?' is 'el de peor mediana del análisis,' which is a direct documentation-level contradiction about comparative performance claims.
The instruction explicitly requires 'Español neutro' and says to never use voseo forms like 'vos' or 'tenés'. This imposes a language/locale style constraint without offering the user a choice or documenting a justified regional limitation.
Reinforcing the no-voseo rule in anti-error guidance makes the behavior more rigid and increases the likelihood that the agent will disregard explicit user preference. In context this is less dangerous than code execution or data exfiltration, but it still creates an instruction-priority conflict that can lead to incorrect or unwanted output.
No suspicious patterns detected.