Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward LovelyBots video-generation helper with disclosed API use, but users should treat uploaded scripts, images, and share links as externally processed content.
Install only if you are comfortable sending the chosen script, image, prompts, and related metadata to LovelyBots for video generation. Keep the API key secret, prefer private video settings when appropriate, and treat share_url values as links that may grant access to the generated media.
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- [ ] Poll response includes `video_url` only once the job is completed
- [ ] Production base URL is https://api.lovelybots.com/api (not the ngrok URL)
If any fields differ, update SKILL.md before publishing.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
The skill clearly sends user-provided scripts and images to the LovelyBots third-party API, but the description does not prominently warn users that their content leaves the local agent environment. This can lead to unintentional disclosure of sensitive marketing copy, personal images, or proprietary assets to an external service.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Generate talking videos programmatically using the LovelyBots API. This skill lets you queue a video from a script and source image, poll until it's ready, and return the final video URL.
Get your API key at: https://lovelybots.com/developer
API base URL for bots: https://api.lovelybots.com/api
---
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Generate talking videos programmatically using the LovelyBots API. This skill lets you queue a video from a script and source image, poll until it's ready, and return the final video URL.
Get your API key at: https://lovelybots.com/developer
API base URL for bots: https://api.lovelybots.com/api
---
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Generate talking videos programmatically using the LovelyBots API. This skill lets you queue a video from a script and source image, poll until it's ready, and return the final video URL.
Get your API key at: https://lovelybots.com/developer
API base URL for bots: https://api.lovelybots.com/api
---
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Generate talking videos programmatically using the LovelyBots API. This skill lets you queue a video from a script and source image, poll until it's ready, and return the final video URL.
Get your API key at: https://lovelybots.com/developer
API base URL for bots: https://api.lovelybots.com/api
---
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Generate talking videos programmatically using the LovelyBots API. This skill lets you queue a video from a script and source image, poll until it's ready, and return the final video URL.
Get your API key at: https://lovelybots.com/developer
API base URL for bots: https://api.lovelybots.com/api
---
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Generate talking videos programmatically using the LovelyBots API. This skill lets you queue a video from a script and source image, poll until it's ready, and return the final video URL.
Get your API key at: https://lovelybots.com/developer
API base URL for bots: https://api.lovelybots.com/api
---
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Generate talking videos programmatically using the LovelyBots API. This skill lets you queue a video from a script and source image, poll until it's ready, and return the final video URL.
Get your API key at: https://lovelybots.com/developer
API base URL for bots: https://api.lovelybots.com/api
---
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Generate talking videos programmatically using the LovelyBots API. This skill lets you queue a video from a script and source image, poll until it's ready, and return the final video URL.
Get your API key at: https://lovelybots.com/developer
API base URL for bots: https://api.lovelybots.com/api
---
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Generate talking videos programmatically using the LovelyBots API. This skill lets you queue a video from a script and source image, poll until it's ready, and return the final video URL.
Get your API key at: https://lovelybots.com/developer
API base URL for bots: https://api.lovelybots.com/api
---
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Generate talking videos programmatically using the LovelyBots API. This skill lets you queue a video from a script and source image, poll until it's ready, and return the final video URL.
Get your API key at: https://lovelybots.com/developer
API base URL for bots: https://api.lovelybots.com/api
---
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Generate talking videos programmatically using the LovelyBots API. This skill lets you queue a video from a script and source image, poll until it's ready, and return the final video URL.
Get your API key at: https://lovelybots.com/developer
API base URL for bots: https://api.lovelybots.com/api
---
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Generate talking videos programmatically using the LovelyBots API. This skill lets you queue a video from a script and source image, poll until it's ready, and return the final video URL.
Get your API key at: https://lovelybots.com/developer
API base URL for bots: https://api.lovelybots.com/api
---
The invocation examples include generic phrases like "Queue a video generation job and give me the download link when it's done" and "Create a talking video for my TikTok ad using LovelyBots" without any explicit trigger boundary, negative examples, or narrow activation context. In a markdown skill description, this can make activation conditions ambiguous and increase the chance of unintended invocation from ordinary user requests.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
9:16 orientation (for example 1080x1920).curl -X POST https://api.lovelybots.com/api/create \
-H "Authorization: Bearer $LOVELYBOTS_API_KEY" \
-H "Content-Type: application/json" \
-d '{
The skill recommends reporting the share_url during processing, but the surrounding text does not warn that this is a public shareable link. Exposing that URL prematurely can grant access to in-progress or completed media to unintended recipients and may bypass user expectations of privacy, especially when public is set to false.
Recommending that agents expose the shareable URL while a job is still queued or processing increases the chance of disclosing access to a private asset before the user has approved sharing. This creates an avoidable confidentiality risk because possession of the link may be sufficient to view or later retrieve the generated content.
No suspicious patterns detected.