Security audit
Security checks for vulnerabilities and agentic risk
This skill coherently generates videos through the Agnes API, with the main user consideration being that prompts and image URLs are sent to an external service and may incur API costs.
Install only if you are comfortable using an Agnes API key and sending your video prompts, image URLs, and generation parameters to Agnes for processing; avoid sensitive or private media unless that external processing is acceptable.
The README presents the skill instructions entirely in Chinese and does not indicate that language is selectable or user-configurable. Under SQP-3, forcing a specific language without user opt-in is a natural-language policy violation.
The skill says it is invoked automatically when the user requests video generation, but it does not define narrow triggering conditions or user confirmation boundaries. That can cause the agent to route common creative/media requests into this skill unexpectedly, leading to unintended external API use, unnecessary spending, and transmission of user content to a third party.
The skill documents that prompts and image URLs are sent to Agnes endpoints, but it does not clearly warn users that their text and media references will be transmitted to an external service. This creates a privacy and consent risk, especially if users provide sensitive prompts, private image URLs, or internal-only resources that the agent then shares with a third party.
The header comment states the script 'returns video URL', establishing clear expected behavior. However, the emitted result at L055-L062 sets url to result.remixed_from_video_id, which appears to be a video identifier/reference rather than a URL, contradicting the documented output intent.
This code sends user-supplied prompt content and optional image input to a third-party service via HTTPS, which can affect user privacy. Although network transmission is central to the script's purpose, the file contains no explicit disclosure, confirmation, or warning that these inputs are being sent off-system.
This markdown file documents setting an AGNES_API_KEY and later sending prompts and image URLs to a remote video-generation service, but it does not warn users that their prompts, referenced media, and job metadata will be transmitted to a third-party service. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data or privacy.
The usage string illustrates the prompt argument exclusively with Chinese text ("描述"), which implies a language expectation without any opt-in or explanation. This can constitute a natural-language locale policy issue because the file does not indicate that other languages are supported or that Chinese is required for a justified regional reason.
No suspicious patterns detected.
