Veed Fabric

• Outcome: Review
• Latest audit: May 28, 2026 · 9:54 AM UTC
• Version: 0.1.0

Overview

This video-generation skill appears legitimate, but it can upload personal images, audio, and scripts to a third-party public CDN without a clear consent gate.

Install only if you are comfortable sending images, audio, scripts, and generated videos to fal.ai/VEED infrastructure, potentially through public CDN URLs. Avoid using confidential media, client content, biometric face/voice data, or private scripts unless the skill is updated to clearly warn before upload, ask for explicit confirmation, and let you choose where downloaded output is saved.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (14)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The documented trigger phrases are generic enough that they may activate during ordinary discussion of video creation rather than an explicit request to run the skill. Because this skill can upload local files to a third-party service and generate/download artifacts, accidental activation increases the chance of unintended data handling and external network actions.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README states that local files may be auto-uploaded to fal.ai CDN and that generated videos are downloaded locally, but it does not prominently warn users about third-party data transfer, storage, retention, or sensitivity considerations. In a media-processing skill that handles headshots, audio, and scripts, this omission can lead users to expose personal or confidential content without informed consent.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger phrase "fabric" is overly broad for a skill activator because it commonly appears in unrelated everyday contexts, increasing the chance of accidental invocation. In an agent setting, false activations can cause the system to load this skill in inappropriate conversations, potentially leading to unintended external API use, file handling flows, or confusing prompts for credentials and uploads.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill routes users to a file-upload workflow for local files but does not clearly disclose in the main description or warning text that those files may be uploaded to fal.ai's CDN. This creates a privacy and data-handling risk because users may provide sensitive local media without understanding that it will be transferred to a third-party service and stored outside the local environment.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The rule explicitly instructs uploading local files to a publicly accessible CDN but does not require warning the user that the uploaded content will become publicly accessible. This creates a real privacy and data-exposure risk because users may provide sensitive headshots or audio files assuming they are only being processed transiently rather than published at a public URL.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly directs local image and audio files to be uploaded and made publicly accessible before sending them to a third-party API, but it does not require user consent or warn about privacy, retention, or exposure risks. Because these inputs are likely to contain biometric face data and voice data, omission of disclosure materially increases the chance of unintended sensitive-data sharing.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs writing a remotely hosted file directly into the local project directory without an explicit user confirmation step, sandboxing guidance, or validation of the destination. Even though saving generated output is part of the skill's purpose, this still creates a filesystem side effect from remote content and could unexpectedly modify a user's workspace or overwrite assumptions about where untrusted files are stored.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to issue a cancellation request that changes remote job state without requiring an explicit user confirmation step or warning about the effect. In an agent setting, ambiguous user messages such as 'stop' or 'cancel' could cause unintended termination of a paid or long-running generation job, resulting in loss of progress and possible user harm.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly instructs the agent to upload a user-provided image to a publicly accessible URL and then submit that URL plus the user's script to a third-party API, but it does not warn the user that their content will leave the local system and become externally accessible. This creates a real privacy and data-handling risk, especially because facial images and spoken scripts may contain sensitive personal or business information.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The spec says local files should be uploaded to fal.ai storage to obtain public URLs, but it does not require explicit user notice or consent that those files will become externally hosted and potentially publicly accessible. Because the inputs are headshots and audio, this can expose sensitive biometric/personal data and surprises users who may assume local-only processing.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The spec directs the skill to create ./output/ and write an MP4 into the working directory without clearly informing the user beforehand. While less severe than the public-upload issue, silent local file creation can leak sensitive generated media into repositories, shared workspaces, or monitored directories and may violate user expectations.

External Transmission

Medium

• Category: Data Exfiltration

Content

CONTENT_TYPE=$(file --mime-type -b "/path/to/local/file.png")
FILE_NAME=$(basename "/path/to/local/file.png")

UPLOAD_RESPONSE=$(curl -s -X POST "https://rest.fal.ai/storage/upload/initiate?storage_type=fal-cdn-v3" \
  -H "Authorization: Key $FAL_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"content_type\": \"$CONTENT_TYPE\", \"file_name\": \"$FILE_NAME\"}")

• Confidence: 88% confidence
• Finding: This step transmits file metadata to an external service to obtain a presigned upload URL, which is part of the exfiltration path for local content. In context, the skill is designed to use a third-party API, so the transmission is expected, but it is still security-relevant because it initiates movement of local user data to an external provider without any stated consent or minimization safeguards.

External Transmission

Medium

• Category: Data Exfiltration

Content

FILE_URL=$(echo "$UPLOAD_RESPONSE" | jq -r '.file_url')
UPLOAD_URL=$(echo "$UPLOAD_RESPONSE" | jq -r '.upload_url')

curl -s -X PUT "$UPLOAD_URL" \
  -H "Content-Type: $CONTENT_TYPE" \
  --data-binary @"/path/to/local/file.png"
```

• Confidence: 97% confidence
• Finding: This command uploads the full contents of a local file to a presigned URL, making the file available via a publicly accessible CDN URL. The skill context increases the danger because it handles user-provided local media files, which may contain sensitive biometric or personal information, and the documentation does not require any warning or confirmation before public exposure.

External Transmission

Medium

• Category: Data Exfiltration

Content

IMAGE_URL=$(echo "$UPLOAD_RESPONSE" | jq -r '.file_url')
UPLOAD_URL=$(echo "$UPLOAD_RESPONSE" | jq -r '.upload_url')

curl -s -X PUT "$UPLOAD_URL" \
  -H "Content-Type: $CONTENT_TYPE" \
  --data-binary @"./headshot.png"

• Confidence: 97% confidence
• Finding: The complete example normalizes direct upload of a local headshot to external storage and then reuse of the resulting public URL. Because headshots are personal data and may be sensitive in some environments, documenting this flow without a privacy warning or safer alternative materially increases the risk of unintended public disclosure.

Static analysis

No suspicious patterns detected.