Security checks across malware telemetry and agentic risk
The skill’s video-generation workflow is mostly coherent, but it includes under-scoped background cron persistence and hardcoded external notifications that users should review before installing.
Install only if you are comfortable auditing and modifying it first. Remove or reconfigure the hardcoded phone number and local paths, avoid installing the cron watcher unless you explicitly need it, inspect your crontab before and after use, store API keys in a safer secret mechanism, and set retention/deletion rules for generated prompts, clips, logs, and reference assets.
image_url = data["data"][0]["url"]
# Download image
img_response = requests.get(image_url)
img = Image.open(BytesIO(img_response.content))
if filename is None:chmod +x scripts/quota_watcher.sh # Add to crontab: (crontab -l 2>/dev/null | grep -v quota_watcher; \ echo "*/30 * * * * /path/to/quota_watcher.sh >> /tmp/quota_watcher.log 2>&1") | crontab - ```
66/66 vendors flagged this skill as clean.