Security audit
Security checks for vulnerabilities and agentic risk
This is a document-only storyboard planning skill with no code, network access, credential handling, or persistence.
Review the broad trigger words if you install many creative-planning skills, since this one may activate for general storyboard or pre-production requests. No security-sensitive behavior was found.
The trigger keywords are generic terms such as 'storyboard', 'shot list', and 'visual plan' without clear activation boundaries, exclusions, or disambiguation rules. This can cause the skill to activate in unrelated contexts, increasing the chance of accidental invocation, response hijacking, or interference with other skills handling broader creative or planning tasks.
The trigger list includes generic phrases like "storyboard," "visual plan," and especially "pre-production," which can appear in ordinary discussion outside the intended narrow skill invocation context. The file does not provide constraints, exclusion conditions, or negative examples to clarify when these terms should and should not activate the skill.
The manifest sets the skill language to "en" with no indication that users may opt into other languages or that English-only behavior is required for a documented reason. This can conflict with language/locale policy expectations when no user choice or justification is provided.
The checklist explicitly states 'English-first documentation,' which imposes a language preference in natural language. Under the policy rules, forcing a specific language without user opt-in or a clearly justified regional constraint is a violation.
This manifest lists generic activation phrases such as "storyboard," "visual plan," and "pre-production" without clarifying context, constraints, or negative examples. Those terms can plausibly appear in ordinary creative discussions, increasing the chance of unintended invocation.
