Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward UGC video workflow, with the main caution that product and brand media may be processed by external generation tools and saved locally.
Before installing, confirm you are comfortable using the referenced external generation tools with product images, branding assets, prompts, and scripts, and review or delete generated files under ~/clawd/outputs/{project} when the campaign is finished.
The invocation examples and all provided dialogue templates are in Spanish/Argentinian Spanish, but the skill does not say this is optional or ask the user which language or locale they want. That creates a natural-language policy concern because the skill appears to default users into a specific language variant without opt-in.
The skill directs use of external API-backed generation tools via COMFY_DEPLOY_API_KEY and writes outputs to persistent local paths, but it provides no warning that user-supplied product images, branding assets, and prompts may be sent to third-party services or retained on disk. This can expose sensitive creative assets or personal data without informed user consent, especially in an automated agent workflow.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Write 4 lines of pure dialogue:
ESCENA 1: [Opening hook - grab attention]
ESCENA 2: [Problem/benefit - relate to audience]
No suspicious patterns detected.