Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent Pruna multi-scene video workflow, but its install instructions use unpinned npx commands to add multiple skills, which deserves review before use.
Review the installation path before using this skill. Prefer a pinned or verified installer and install only the specific Pruna companion skills you need rather than the full suite. Keep PRUNA_API_KEY private, expect uploaded references to be sent to Pruna services, and use only rights-cleared media.
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Motion-template voice_prompt (do):
Clear conversational delivery throughout — speaking directly to camera. Natural pacing with real pauses.
When motion-source prompts change, delete cached motion-source stills before regen. See animate-beats.md.
The skill instructs the agent/user to execute npx skills add ... commands that rely on whatever skills package is currently resolved by npm at runtime rather than a cryptographically pinned, immutable toolchain. In an agent setting, this creates a supply-chain risk: a compromised or typosquatted package, changed transitive dependency, or registry-side package update could cause unreviewed code execution during install.
This line repeats the same unpinned npx skills add ... installation pattern, which allows execution of package-manager-resolved code outside the reviewed skill contents. Because npx may fetch and run code on demand, the instruction expands the trusted computing base to the npm registry state at execution time.
The skill continues to direct use of an unpinned npx skills command, which is a classic supply-chain weakness for agent workflows. A later package update or dependency compromise could silently alter behavior and execute malicious code while the user believes they are following trusted documentation.
This installation instruction is materially the same risky pattern: on-demand execution of unpinned npm-delivered tooling. In the context of an agent skill, that can lead to remote code execution on the operator machine or build environment if the upstream package path is compromised.
This line exposes the same package-resolution risk by instructing the use of npx skills without pinning the executing tool. Since agent operators may copy these commands directly, the skill effectively normalizes unsafe installation of executable third-party code.
The 'install the full suite once' command broadens the blast radius because it fetches a larger package set through the same unpinned npx skills mechanism. If abused, compromise of the installer or suite package could affect all subsequent skill operations and provide a stronger foothold than a single narrowly scoped dependency.
The instruction to 'Follow this skill in plain language when talking to the person requesting the video' imposes a communication style but does not explicitly allow for the user's preferred language or locale. Because the policy category covers language or locale constraints, this can be interpreted as forcing a default language behavior without user opt-in.
The related-skills section again directs runtime installation via unpinned npx skills, reintroducing the same supply-chain execution hazard. Repetition in a discovery/install section increases the chance users or agents will execute it without scrutiny.
This is another instance of the same unpinned executable package-install pattern. In practice, any of these commands could become the initial compromise point if the package ecosystem entry is tampered with.
The line remains vulnerable because it depends on mutable package registry state at execution time. That is especially risky for automation agents, which may run such commands unattended and grant an attacker reliable code-execution opportunities.
This repeated npx skills guidance creates an avoidable supply-chain entry point by executing a non-immutable tool resolution path. The vulnerability is not in the media workflow itself but in how prerequisite tooling is acquired and run.
Like the prior instances, this instruction can lead to execution of attacker-controlled code if the npm package, namespace, or a dependency is compromised. Because it appears in a 'related skills' table, users may treat it as harmless navigation when it is actually an execution path.
The description says to use the skill when someone wants 'the same person hosting several clips' and lists broad examples like 'comparison reels' or 'mixed speaking and animated scenes.' Without clearer boundaries or negative examples, this could match common multi-clip video requests that may belong to other skills, increasing the chance of unintended invocation.
No suspicious patterns detected.