Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward local video-processing guide with expected FFmpeg and optional local transcription workflows, and no evidence of hidden behavior or unsafe persistence.
Installers should understand that this skill will guide an agent to process local media files and create derived outputs. Use it on files you are authorized to edit or transcribe, choose unique output names, and avoid processing confidential recordings unless local handling and retention are acceptable.
The workflow explicitly transcribes audio content with Whisper but provides no privacy, consent, or sensitive-data handling guidance. In a video-processing skill, this can lead users to process recordings containing personal, confidential, or regulated spoken content without realizing the legal and privacy implications, especially for meetings, classrooms, interviews, or client material.
This markdown file provides many ffmpeg commands that write new output files, but it does not include any warning that running these commands will create or replace files on disk. Because SQP-2 applies to markdown files when descriptions omit warnings about behaviors affecting user data or system integrity, the lack of any caution about output-path handling is a minor safety disclosure gap.
Line L042 states "Always use AAC for maximum compatibility," which is a natural-language instruction forcing a specific technical choice without presenting it as conditional guidance or offering alternatives. Under the policy rule, absolute language that imposes a fixed option without user opt-in or clear scope can be considered a policy-style constraint violation.
No suspicious patterns detected.
