Security audit
Security checks for vulnerabilities and agentic risk
The skill does not appear to steal data or persist access, but it falsely reports a completed video merge without actually using the supplied media inputs or creating output.
Review this before installing because the package appears to be a nonfunctional or placeholder implementation: it accepts media URLs and claims a finished merge, but no merge occurs. There is no evidence of exfiltration or persistence in the inspected artifact, but users should not rely on its output without verifying that a real merged file is produced.
The returned message is hard-coded in Chinese ("合成完成：视频+音频+字幕已合并为9:16竖屏成片") with no indication that the skill is region-specific or that users can opt into a preferred language. This is a natural-language policy concern because it imposes a specific locale on all users.
This manifest states that the skill combines video, audio, and subtitles and accepts URL inputs, which implies network retrieval of user-supplied media and creation of a derived output artifact. The description does not include any warning about handling external content or generating output that may affect user data/privacy, which is expected for markdown/manifest-facing skill descriptions.
No suspicious patterns detected.
