Security audit

雀影

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed creative video-prompt skill; the main caveat is that its broad trigger terms may activate it in general video-related conversations.

Install this if you want a Chinese-language assistant for video storyboarding and Seedance prompt creation. Be aware it may activate on broad video-related requests, and it can write or edit creative output files as part of the workflow.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger list includes broad, commonly used phrases such as '视频生成', 'AI视频', '分镜', and '字幕', which can cause the skill to activate in conversations that are not specifically requesting this skill. This increases the risk of unintended invocation, context hijacking, and confusing or disruptive behavior, especially because the skill has file read/write capabilities.

Static analysis

No suspicious patterns detected.