Fableforge

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:22 AM UTC
• Version: 1.2.0

Overview

This is a coherent video-production skill, but it asks agents to install and run unverified tools, use voice cloning by default, and perform repository actions that need careful user review.

Install only if you are comfortable with a video-generation SOP that modifies the workspace, downloads executable tools and media, installs packages, and may use a voice clone. Before running it, require confirmation for all downloads, package installs, voice-clone use, Git commits, and any push; add real .gitignore protection for voice samples; remove curl -k; pin and verify dependencies; and review all generated promotional content before rendering or publishing.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T01 · Skill Instruction Hijacking

Error

• Location: resources/stages/stage_1_creatives.md:196
• Finding: Mandatory Promotional Content Injection into User Deliverables<![CDATA[ ## Vulnerability Details **File Location**: `resources/stages/stage_1_creatives.md:196-202`, `resources/stages/stage_3_static.md:197-207`, `resources/stages/stage_5_publish.md:15-39`, `SKILL.md:207` **Vulnerability Type**: Output and instruction hijacking **Risk Level**: High ### Vulnerable Code Snippet The Stage 1 instructions prescribe a fixed end-card message: ```text The end-card content is fixed as: "👍 Like ⭐ Favorite 🔔 Follow See you next time! — [user-specified account name]" ``` Stage 3 makes these engagement prompts mandatory in generated HTML: ```html <div id="scene_end" class="clip" data-start="{last scene end time}" data-duration="{8-10 seconds}" data-track-index="1" style="z-index: 99;"> <div class="scene-content"> <div class="text-layer text-layer--center"> <div id="end-line1" class="headline">👍 Like ⭐ Favorite</div> <div id="end-line2" class="headline">🔔 Follow</div> <div id="end-cta" class="caption-text">See you next time! — {signature}</div> </div> </div> </div> ``` Stage 5 also requires promotional material to be appended: ```text At the bottom of the video script, mandatorily append a Xiaohongshu-specific promotional plan containing: 1. At least 3-4 viral title recommendations. 2. Cover-image text recommendations. 3. A 300-500-character promotional post with emojis, an interaction hook, and popular hashtags. ``` ### Technical Analysis The Skill changes the expected output contract by requiring engagement prompts and platform-specific marketing material in every deliverable. These requirements are not conditional on the user's request or explicit approval. Because the instructions are marked as fixed or mandatory, an Agent following the Skill will insert promotional content even when the user only requested video generation. This is a direct alteration of the Agent's session goals and final output. ### Attack Path 1. A user loads the Skill to create a video. 2. The Agent f ...[truncated 741 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all fixed and mandatory engagement prompts. 2. Make end cards and social-media campaigns optional configuration features. 3. Ask for explicit user approval before adding any call-to-action, account signature, hashtag set, or platform-specific marketing text. 4. Default to a neutral end card when the user has not requested promotion. 5. Add a content manifest showing every promotional element before rendering. 6. Ensure that omission of promotional material does not block Stage 3, Stage 4, or Stage 5 completion. ]]>

T08 · Insecure Dependencies

Error

• Location: resources/stages/stage_0_env.md:20
• Finding: Execution of Unverified and Unpinned Third-Party Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `resources/stages/stage_0_env.md:20-32`, `SKILL.en.md:443-445`, `resources/stages/stage_2_timeline.md:15`, `resources/stages/stage_4_animation.md:46-74` **Vulnerability Type**: Third-party software supply-chain exposure **Risk Level**: High ### Vulnerable Code Snippet ```bash curl -L https://evermeet.cx/ffmpeg/get/zip -o ffmpeg.zip && unzip -o ffmpeg.zip curl -L https://evermeet.cx/ffmpeg/get/ffprobe/zip -o ffprobe.zip && unzip -o ffprobe.zip mkdir -p bin && mv ffmpeg bin/ && mv ffprobe bin/ && chmod +x bin/* rm ffmpeg.zip ffprobe.zip ``` ```bash python3 -m venv voice-model/venv source voice-model/venv/bin/activate pip install voxcpm soundfile torch numpy ``` ```bash npx hyperframes transcribe YYYYMMDD/assets/narration.wav ``` ```bash npx hyperframes@latest inspect YYYYMMDD/ npx hyperframes@latest render YYYYMMDD/ \ -o YYYYMMDD/renders/promo_video.mp4 --force-new ``` ### Technical Analysis The Skill downloads executable FFmpeg and FFprobe binaries and immediately marks them executable without verifying a cryptographic checksum or digital signature. Python packages are installed without exact versions or a lockfile. The Node.js workflow also invokes `hyperframes@latest`, which intentionally resolves to a mutable release. Package installation and `npx` execution can run package lifecycle scripts under the Agent's current account. Consequently, the code executed during initialization or rendering may differ from the code reviewed during this audit. ### Attack Path 1. The Agent initializes a project or enters the transcription/rendering stages. 2. It downloads a mutable binary archive or resolves an unpinned package. 3. A compromised server, registry account, dependency, or newly malicious package release supplies altered code. 4. The Agent installs or executes that code. 5. The supplied code runs with the Agent process's filesystem, network, and user-account permissions. ### Impact Assessment Succ ...[truncated 617 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every Python and Node.js dependency to an audited exact version. 2. Use lockfiles with integrity metadata, such as `package-lock.json` and a hash-locked Python requirements file. 3. Replace `hyperframes@latest` with an exact version. 4. Use `npx --ignore-existing --package hyperframes@<exact-version>` only with a reviewed lock and integrity policy, or install from a controlled local environment. 5. Download FFmpeg from a trusted official or approved distribution source. 6. Publish expected SHA-256 hashes in the Skill and verify them before extraction or execution. 7. Prefer signature verification where upstream signatures are available. 8. Extract archives into a temporary directory and verify expected filenames before moving binaries into `bin/`. 9. Run media tools and package installation in a sandbox with minimal filesystem and network access. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: resources/stages/stage_1_creatives.md:163
• Finding: TLS Certificate Verification Disabled for Media Downloads<![CDATA[ ## Vulnerability Details **File Location**: `resources/stages/stage_1_creatives.md:163-164` **Vulnerability Type**: Insecure transport configuration **Risk Level**: High ### Vulnerable Code Snippet ```bash curl -L -k --retry 5 --retry-delay 3 \ -H "User-Agent: Mozilla/5.0 ..." \ "https://videos.pexels.com/..." \ -o scene.mp4 ``` The instructions also allow a nonzero `curl` result to be accepted when `ffprobe` can parse the file. ### Technical Analysis The `-k` option disables TLS certificate validation. This permits `curl` to accept certificates that are expired, self-signed, issued for another hostname, or supplied by an active network attacker. The downloaded file is subsequently parsed and transcoded by FFprobe and FFmpeg. File parseability is not an authenticity or integrity check. An attacker-controlled media file can therefore enter a complex native-code parser merely by being accepted by `ffprobe`. ### Attack Path 1. The Agent executes the generated media-download script on an untrusted or intercepted network. 2. An attacker impersonates the media host using an invalid certificate. 3. Because `curl -k` disables authentication, the Agent accepts the connection. 4. The attacker supplies substituted or malformed media. 5. The file is passed to FFprobe and FFmpeg for validation, cropping, or transcoding. 6. The attacker may manipulate the rendered output or target vulnerabilities in the installed media parser. ### Impact Assessment At minimum, exploitation can replace expected B-roll footage and compromise the integrity of rendered videos. If the installed FFmpeg build contains a vulnerability reachable through crafted media, the impact could extend to arbitrary code execution with the Agent's user-level privileges. The affected scope includes project files, accessible local data, and network resources available to the process. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `-k` option and require successful certificate and hostname validation. 2. Restrict downloads to an explicit allowlist of HTTPS hostnames. 3. Reject redirects to hosts outside the allowlist. 4. Set maximum file sizes, connection timeouts, and download timeouts. 5. Check the HTTP status code and content type before accepting a response. 6. Validate the media container, dimensions, duration, codec, and stream count in a sandbox. 7. Treat any failed or interrupted transfer as invalid unless an independently authenticated checksum is available. 8. Keep FFmpeg patched and run parsing/transcoding under reduced privileges. ]]>

T08 · Insecure Dependencies

Warning

• Location: resources/template/index.html:35
• Finding: Remote JavaScript Executed Without Subresource Integrity<![CDATA[ ## Vulnerability Details **File Location**: `resources/template/index.html:35` **Vulnerability Type**: Unverified browser-side dependency **Risk Level**: Medium ### Vulnerable Code Snippet ```html <script src="https://cdnjs.cloudflare.com/ajax/libs/gsap/3.12.5/gsap.min.js"></script> ``` ### Technical Analysis The template loads executable JavaScript from a third-party CDN every time the document is previewed or rendered. Although the URL includes a version number, no Subresource Integrity hash is provided. If the CDN response is altered, the browser will execute the changed content in the document context. This makes the effective executable payload dependent on an external server after the Skill has been audited. ### Attack Path 1. A generated project is opened in a browser or rendering runtime. 2. The document requests GSAP from the external CDN. 3. The CDN account, delivery path, or dependency artifact is compromised. 4. A modified JavaScript response is returned. 5. The browser executes the response in the project page. 6. The script can alter the composition, inspect page data, and make network requests subject to the runtime's security model. ### Impact Assessment The direct scope is the HTML rendering context. A malicious script could: - Alter subtitles, images, timelines, or rendered content. - Read data exposed to the page. - Send page-accessible information to a remote service. - Trigger network requests. - Abuse additional capabilities if the rendering environment exposes privileged browser or Node.js integrations. The repository does not show that the current CDN resource is malicious; the risk results from missing integrity enforcement. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Vendor the audited GSAP file inside the Skill and load it through a local relative path. 2. If CDN loading is unavoidable, add a verified `integrity` attribute and `crossorigin="anonymous"`. 3. Define a restrictive Content Security Policy that only permits required local resources. 4. Disable unnecessary network access during deterministic rendering. 5. Record the exact dependency hash in the release manifest. 6. Revalidate the vendored artifact whenever the dependency version changes. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: resources/voice-model/README.md:62
• Finding: Voice-Biometric Sample Is Not Protected by the Claimed Git Exclusion<![CDATA[ ## Vulnerability Details **File Location**: `resources/voice-model/README.md:62-68` **Vulnerability Type**: Sensitive biometric data handling failure **Risk Level**: High ### Vulnerable Code Snippet ```text Save the recording as: voice-model/01_samples/my_voice.wav Privacy notice: This file contains your voiceprint information. The .gitignore automatically excludes the 01_samples directory, so it will not be committed to GitHub. ``` The audited project root contains only: ```text SKILL.en.md SKILL.md resources/ ``` No `.gitignore` file is present. ### Technical Analysis The instructions correctly identify the recording as voice-biometric information but assert that an automatic Git exclusion exists when the package does not provide one. Users and Agents may rely on this false assurance. Because later workflow stages use broad Git staging commands, the voice sample could be included if it is created under a path covered by those commands or if the surrounding repository is staged more broadly than the example. A `.gitignore` rule is only a convenience and is not sufficient after a file has already been tracked, but its complete absence makes the documented safeguard ineffective from the outset. ### Attack Path 1. A user records a voice sample and stores it at the required path. 2. The user relies on the documentation's claim that the directory is automatically ignored. 3. The Agent or user stages project files with Git. 4. Because the promised exclusion does not exist, the sample may be staged and committed. 5. A later push or repository synchronization can disclose the biometric recording to remote collaborators or a public repository. ### Impact Assessment The exposed asset is a reusable biometric voice sample that can support voice imitation or cloning. Unlike a password, a person's voice characteristics cannot be easily changed after disclosure. The issue does not itself grant operating-system privileges. Its scope is confidentiality ...[truncated 87 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Include a project-root `.gitignore` with at least: ```gitignore voice-model/01_samples/ **/voice-model/01_samples/ *.voice-sample.wav ``` 2. Verify the rule during initialization: ```bash git check-ignore -v voice-model/01_samples/my_voice.wav ``` 3. Abort initialization if the sample is inside a Git repository and the exclusion is not effective. 4. Warn that `.gitignore` does not protect files that are already tracked. 5. Before committing, check for staged audio samples using `git diff --cached --name-only`. 6. Store samples outside the repository by default and reference them through configuration. 7. Define retention and secure-deletion guidance. 8. Require explicit consent before using a voice sample for cloning. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.en.md:397
• Finding: English Workflow Automatically Pushes Repository Changes Without a Confirmation Gate<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.en.md:397-408`; conflicting safer behavior appears in `resources/stages/stage_5_publish.md:51-55` **Vulnerability Type**: Unauthorized remote publication **Risk Level**: High ### Vulnerable Code Snippet ```bash git add YYYYMMDD/ README.md git commit -m "feat: Add {video_title} project" git push origin main ``` ```text Stage 5 exit criteria: - Script file contains full metadata. - README demo table is updated. - git push is successful. ``` The modular Stage 5 instructions conflict with this behavior: ```bash git add YYYYMMDD/ README.md git commit -m "feat: Add {video_title} project" # The user decides when to push; do not push automatically. ``` ### Technical Analysis The English workflow makes a successful push to `origin main` part of the completion criteria without requiring confirmation immediately before publication. This contradicts the safer modular workflow, which explicitly limits automation to a local commit. A Git push uses the user's configured credentials and modifies a remote repository. Even if the Agent has legitimate repository access, remote publication is a higher-impact action than local video generation or local archiving. The conflicting instructions also make behavior dependent on which Skill document the Agent prioritizes. ### Attack Path 1. A user requests video generation or local project archiving. 2. The Agent follows `SKILL.en.md`. 3. It stages generated project files and modifies `README.md`. 4. It creates a local commit. 5. Without a final publication confirmation, it executes `git push origin main`. 6. Generated or unintended content is published to the configured remote branch. ### Impact Assessment The command does not create new privileges, but it consumes existing Git credentials to perform a remote write without a dedicated authorization checkpoint. Potential impact includes: - Unauthorized publication of generated media and metadata. - Disclosure of fi ...[truncated 320 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `git push` from all automatic workflow and exit criteria. 2. Standardize both language versions on the safer commit-only behavior. 3. Display the remote URL, branch name, and commit diff before publication. 4. Require explicit user confirmation immediately before every push. 5. Use a feature branch rather than pushing directly to `main`. 6. Prefer a pull-request workflow with branch protection. 7. Check the staged file list for sensitive recordings, credentials, generated binaries, and unexpectedly large media files. 8. Do not treat refusal to push as a failed video-production stage. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (33)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```

**下载容错规范：**
- `curl -L -k --retry 5 --retry-delay 3 -H "User-Agent: Mozilla/5.0 ..."` — Pexels CDN 需要浏览器 UA，且 SSL 连接不稳定
- 若 curl 返回非零但文件通过 `ffprobe` 校验 → 视为下载成功（Cloudflare 常在传输末尾断开连接）
- 已存在的有效视频自动跳过（断点续传）

• Confidence: 97% confidence
• Finding: The workflow explicitly recommends `curl -k`, which disables TLS certificate validation when downloading remote media. That makes the agent trust potentially spoofed HTTPS endpoints and enables man-in-the-middle delivery of tampered files; in this skill, the danger is amplified because downloaded content is then treated as valid if `ffprobe` passes, which checks media structure rather than authenticity.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**Deduplication check**: Before generating, scan all `YYYYMMDD/script-template.md` files in the workspace to ensure the theme does not repeat a previous work.

⛔ **After this step: STOP. Present the full allegory to the user and await explicit confirmation. Do not continue without confirmation.**

### 1.2 Storyboard Conversion (after user confirmation)

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill directs the agent to access a local user voice-clone environment and copy/run local cloning scripts by default. That expands scope from generic media generation into identity-adjacent biometric processing and local file/system access, creating privacy, consent, and misuse risks if the agent uses a voice clone without explicit user approval.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The SOP says the agent must use the user's voice clone by default if the environment exists, without any consent, privacy, or impersonation warning. Because voice data is biometric and can be used for identity mimicry, a default-use instruction materially increases the risk of non-consensual cloning or misleading synthetic speech generation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence
• Finding: The skill invokes `npx hyperframes` without pinning an exact package version, which allows whatever version is current in the registry at execution time to be fetched and run. In an agent setting this creates a supply-chain risk: a compromised, typosquatted, or breaking upstream release could execute unintended code on the user's machine.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The skill includes repository modification, commit, and remote push steps as part of the SOP, which grants the agent authority to change and publish project state beyond simple video generation. In an agent context, this can cause unauthorized code/content publication, leakage of generated assets or metadata, and unintended modification of version-controlled files.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The environment setup instructs downloading and installing executable binaries via `curl` and `unzip` directly into the local environment, without warning or verification steps. This exposes users to supply-chain compromise and unsafe local environment modification if the download source is tampered with or the commands are run automatically by an agent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly instructs the agent to download static ffmpeg/ffprobe binaries, fetch B-roll media, and acquire background music, but it does not clearly warn the user that network access and third-party transfers will occur. In an agent setting, silent external downloads can expose prompts, project metadata, or usage patterns to outside services and can introduce supply-chain risk from untrusted binaries or media sources.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill directs the agent to perform network downloads and modify the local filesystem automatically, but it does not require an explicit warning or fresh user consent before doing so. This is dangerous because it changes the user's environment, fetches executable tooling from the internet, and could expose users to supply-chain or integrity risks if the remote resource is replaced, intercepted, or simply unexpected in their environment.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs automatic creation of a Python virtual environment and installation of packages without warning the user that code will be installed and executed locally. This is risky because package installation can run setup logic, consume system resources, alter the workspace, and introduce supply-chain exposure, especially when the user has not explicitly consented to environment changes.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The script template requires narration to be in Chinese and allows visuals with Chinese text, and later poster generation explicitly requires only Chinese typography. This is a natural-language locale constraint presented as mandatory behavior, with no user opt-in or alternative language option.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The entire skill guidance is written as a prescriptive workflow in Chinese, including required labels and output conventions, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-only regional context. Under the language/locale policy rule, a skill that effectively forces one language without opt-in is a natural-language policy concern.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The command `npx hyperframes transcribe ...` invokes a package without pinning an exact version, which can cause unreviewed upstream code to be fetched and executed at runtime. In a production SOP, this creates supply-chain risk: a compromised or breaking new release could alter outputs, execute malicious install scripts, or introduce unsafe behavior on operator machines.

Natural-Language Policy Violations

Medium

• Confidence: 78% confidence
• Finding: This markdown file is written entirely in Chinese and presents all required on-screen text examples, CTA text, and instructions in Chinese without offering any language or locale choice. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly documented and justified, which is not present here.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The document instructs users to run `npx hyperframes inspect` without pinning an exact package version. `npx` may fetch and execute the latest published package at runtime, which creates a supply-chain risk if the package is compromised, typosquatted, or updated with breaking or malicious behavior. In this skill context, that risk is more credible because the command is presented as a required validation step in a production SOP.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The stage exit criteria require `npx hyperframes lint .` without an exact version pin. This can cause arbitrary third-party code to be downloaded and executed during linting, exposing users to supply-chain compromise and non-reproducible builds. Because it is framed as a mandatory quality gate, users are more likely to execute it automatically, increasing practical risk.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: This markdown file contains user-facing operational instructions exclusively in Chinese, and there is no note offering an alternate language or stating that the skill is intentionally limited to Chinese-speaking users. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The workflow executes `npx hyperframes` without pinning an exact package version, which allows the latest published package to be fetched at execution time. In a build/render pipeline, that creates a supply-chain risk: a compromised upstream release or unexpected breaking change could execute unreviewed code on the operator's machine or CI environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The pre-render checklist references `npx hyperframes lint` without a pinned version, so the command may resolve to whatever package version is current at runtime. Because `npx` can download and execute remote code, this exposes the local workstation or CI runner to supply-chain compromise and undermines reproducibility of the security gate.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The instruction `npx hyperframes render` is unpinned and therefore can execute a newly published package version during a sensitive rendering step. In this skill's context, users are explicitly told to run the command locally, which makes the document operationally dangerous because it turns documentation into a direct path for remote code execution via the package registry.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The stage explicitly instructs adding a '声纹' field that includes cloned voice metadata such as 'VoxCPM2 用户克隆', normalizing publication and archival of biometric/voice-clone provenance without any privacy, consent, or disclosure guidance. In a production pipeline for public video distribution, this can lead to unauthorized use or exposure of biometric identifiers, weak consent practices, and downstream compliance/privacy violations.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: Line L34 specifies 'with Chinese labels' as a required prompt pattern for diagrams/concept art. This forces a specific language output without user opt-in, which matches the natural-language policy category for language or locale constraints.

Static analysis

No suspicious patterns detected.