Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it says: it helps create timed lyric audio files and a playback guide, with only ordinary file-writing risks to consider.
Install only if you are comfortable with the agent reading the lyrics file you provide and writing generated audio plus playback.txt to an output folder. Use a dedicated per-project output directory rather than a broad shared folder, and review Discord messages before sending if the lyrics are sensitive or copyrighted.
The skill instructs the agent to read lyric files and write generated audio plus a playback manifest, but it does not declare any explicit tool scope or permissions boundaries. This increases the chance of unintended filesystem access or writes outside the intended workspace, especially because the example uses a concrete local path shared with another component.
The skill directs creation of MP3 files and a playback.txt manifest in a shared folder accessible by both the bot and agent, but it provides no warning or safeguards around shared-directory writes. In context this is not overtly malicious, but shared output locations can expose generated content to other processes, cause accidental overwrites, or leak sensitive local path information.
No suspicious patterns detected.
