Security audit
Security checks for vulnerabilities and agentic risk
The plugin’s media uploads, account connection, and optional interface setup fit its stated Kling AI purpose and preserve user control.
Use only reference media you want Kling AI to receive; uploads may precede final paid-generation approval. Review generation settings and credit use before confirming. Optional MCP Apps setup enables interactive HTML from configured MCP servers and briefly restarts the Gateway.
The skill instructs the agent to upload attached media to a remote service, but does not require informing the user that their images, video, or audio will be transmitted to Kling AI. The confirmation requirements cover generation settings and credit consumption, not disclosure of the media transfer.
The instruction to upload local media before using it is an operational step, not merely a tool listing. The file does not warn users that this transfers their media to the provider, which could expose private or sensitive content.
The skill directs the agent to upload attached reference media to a remote provider without explicitly informing the user that their files will leave the host environment. Such media could contain private faces, confidential product designs, or embedded metadata, and the generation confirmation does not explicitly cover this transfer or necessarily precede uploading. Third-party processing is expected for a Kling AI workflow, which reduces suspicion of malicious intent but does not eliminate the disclosure gap.
These steps instruct the agent to transmit file metadata and the binary media file to the provider's upload service. The workflow does not require informing the user that their local media will leave the host and be processed by an external service; protecting upload credentials does not disclose this data transfer.
This is an instruction to transfer attachments to a third-party service, not merely a listing of an upload tool. Although the skill requires confirmation of generation settings and credit consumption, it does not require telling users that their attachments will be sent to Kling AI.
The supplied commands perform platform configuration and service lifecycle operations, not Kling AI workflows. Although configuration can support an integration, this chunk neither identifies Kling nor establishes that these broader changes are required for a declared operation.
No suspicious patterns detected.
