Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed LinkDigest helper that reads a user-provided video link with an API key and helps rewrite a script structure, with no evidence of hidden persistence, unrelated data access, or destructive behavior.
Before installing, be comfortable providing a LinkDigest API key and sending the benchmark video link or share text to linkdigest.dev, where credit charges may apply. Do not provide private or login-only content, and review generated scripts for originality because the skill intentionally imitates structure while warning against copying original wording.
The skill invokes shell/Python, uses an API key from the environment, and performs network access, but it does not declare an explicit tool scope or permissions boundary. That increases the chance the agent can execute this skill with broader-than-necessary capabilities, making accidental secret exposure, unintended command execution, or unauthorized network use harder to constrain or audit.
The trigger phrases are broad enough that the skill may activate on loosely related requests about rewriting or analyzing scripts, causing the agent to fetch external URLs and use privileged tooling when the user did not clearly intend that workflow. In a skill with network, shell, and secret-bearing API access, over-broad activation expands the attack surface for prompt-trigger abuse and unintended data handling.
The natural-language instructions, examples, and output expectations are entirely Chinese and imply a fixed-language interaction model. There is no indication that users may choose another language or that the Chinese-only behavior is a documented, justified locale constraint.
No suspicious patterns detected.
