Security audit
Security checks for vulnerabilities and agentic risk
This skill gives normal video-stitching instructions using FFmpeg or Remotion, with no hidden persistence or unrelated data access found.
Install only if you are comfortable giving the agent access to the video, subtitle, and music paths or media URLs you provide. Use trusted media sources and review generated FFmpeg commands before running them on sensitive files.
The natural-language instructions and documentation are presented entirely in Chinese, aside from a few embedded English trigger phrases, and there is no indication that users can choose another language. Per the policy, forcing a specific language without user opt-in is a locale-policy concern.
The skill explicitly allows clip inputs as local paths or URLs, but it does not warn that processing those values may cause the system to fetch remote content or access internal files. In a video-processing context, this can enable SSRF-like network access, unintended retrieval of attacker-controlled media, or processing of sensitive local/remote resources without user awareness.
No suspicious patterns detected.
