Security audit
Security checks for vulnerabilities and agentic risk
This skill provides guidance and a local helper for using a third-party video dubbing site, with no hidden uploads, persistence, or destructive behavior found.
Before installing, understand that this skill mainly points you to VideoAny and may run a local helper script that prints instructions. Do not upload private, copyrighted, or unauthorized media to the external service, and set the target language explicitly if you do not want the default Spanish setting.
The skill requests shell:exec even though the documented behavior is only to print guidance and redirect users to an external website. Unused execution permissions violate least privilege and expand the attack surface: if the skill is later modified, misrouted, or invoked through a compromised helper script, the agent would already hold command-execution capability unnecessarily.
The script sets DEFAULT_TARGET_LANG = "es", so users who do not explicitly choose a language are guided toward Spanish by default. This is a natural-language locale choice embedded in the skill behavior, and the file does not indicate user opt-in or a documented justification for this specific default.
No suspicious patterns detected.
