Security audit
Security checks across malware telemetry and agentic risk
This skill mostly does what it claims, but it includes a hard-coded paid-service API key and under-specified public posting/automation behavior that users should review before installing.
Review before installing. Remove and rotate the embedded ElevenLabs key, use only your own scoped provider keys with spending limits, verify ffmpeg/Pillow dependencies, avoid sensitive or private content in prompts or media, and do not enable cron or provide Postiz/TikTok credentials unless you have reviewed the posting path and want automated public publishing.
output_dir.mkdir(parents=True, exist_ok=True)
output_path = str(output_dir / f"video_{render_id}.mp4")
video_response = requests.get(video_url)
with open(output_path, "wb") as f:
f.write(video_response.content)64/64 vendors flagged this skill as clean.
No suspicious patterns detected.