Security audit
Security checks for vulnerabilities and agentic risk
This video-making skill needs review because it can spend account credits while directing the agent to hide costs and usage from you.
Before paid use, require cost estimates, an approved spending limit covering retries, and retained usage records. Confirm which photos and voice material will reach HyperFrames and HeyGen. Use a reviewed CLI version and inspect downloaded template tools. The bundled instructions establish the transparency concern; external tools' budget enforcement could not be verified.
The template descriptions prescribe English or Chinese output, while the selection instructions allow a template to be chosen automatically when the topic fits only one. This can select the episode's language without user opt-in, and the file does not explain why those language restrictions are necessary.
This invokes an unpinned npm CLI, not an MCP server. If no suitable local installation exists, npx can fetch a mutable release, exposing the agent's environment and credentials to a compromised package; requiring this on every start increases exposure.
The login command uses an unpinned npm CLI rather than an MCP server. A compromised release fetched by npx could execute with user privileges and intercept authentication material; asking the user to run it does not remove that risk.
The subscription command invokes an unpinned npm CLI, not an MCP server. If npx fetches a compromised release, it could execute arbitrary code or manipulate the billing workflow using the user's authenticated context.
The template-pull command runs an unpinned npm CLI rather than an MCP server. When npx resolves and downloads a release, a compromised package can execute before any server-side plan check and can alter the downloaded project.
Media generation uses an unpinned npm CLI, not an MCP server. A compromised release fetched by npx could access project media, credentials, and paid-generation capabilities with the invoking user's permissions.
The skill explicitly suppresses prices, estimates, balances, and usage information both from the user and from run records while directing paid media generation. Optional credit limits and storyboard approval provide some protection, but they do not restore informed spending consent or an auditable record of charges.
Avatar generation runs through an unpinned npm CLI, not an MCP server. A compromised package fetched by npx could access the user's photo, narration, credentials, and paid-generation permissions.
The avatar-listing command invokes an unpinned npm CLI rather than an MCP server. If npx fetches a compromised release, that code could access authentication material and private account metadata with the user's privileges.
The workflow directs cloud avatar and voice processing involving personal likeness and narration without explicitly explaining the external transfer or obtaining specific consent for it. Naming HeyGen and requesting the user's own media reduces ambiguity, but storyboard approval is not necessarily informed consent to upload sensitive identity-related media.
Resolving a voice identifier uses an unpinned npm CLI rather than an MCP server. If npx downloads a compromised release, it can execute arbitrary code and expose account credentials or voice metadata even though the intended operation only lists voices.
The repeated voice-listing instruction invokes an unpinned npm CLI, not an MCP server. Fetching a compromised release through npx could expose private voice metadata and execute with the agent's filesystem and credential access.
The voice-planning command uses an unpinned npm CLI rather than an MCP server. Its --plan flag may prevent intended media generation, but it does not prevent malicious package code from executing if npx fetches a compromised release.
Preview launches an unpinned npm CLI, not an MCP server. If npx retrieves a compromised release, it can execute with project access, and background execution does not reduce that supply-chain risk.
The detached render command invokes an unpinned npm CLI rather than an MCP server. A compromised release fetched by npx could execute with user privileges, and detaching the process could allow that execution to continue after the initiating shell exits.
The triggers "an episode of" and "in the style of" can occur in requests unrelated to these video templates, including writing and illustration requests. Although the description names the supported styles, it does not explicitly require a video-template request before applying these generic triggers.
