uni-vision-engine

• Analyzed: May 11, 2026, 5:49 AM
• Findings: 1
• Version: 1.0.2
• Hash: 0394c760ac6c404ac5a6e3f760e9b6a8c7c2a707aaf6f6f2d5cc08ecd97dfcb2
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill contains a hardcoded session token in `scripts/generate.js` and uses `execSync` to dynamically install the `form-data` NPM package at runtime, which is a risky practice. While the behavior aligns with the stated purpose of interfacing with a local Docker-based video generation API (localhost:5100), the inclusion of hardcoded credentials and the use of shell execution for dependency management are significant security vulnerabilities.