Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed workflow guide for generating a single approved avatar video, with user approval gates before paid generation.
Before installing, review the PrunaAI skill package source and consider using pinned, trusted versions of the `skills` CLI and referenced skills. Expect this skill to upload user-provided or generated media to Pruna APIs and to require explicit approval before paid avatar generation.
The skill instructs users to run npx skills add ... without pinning the skills CLI itself to an exact version or digest. If the resolved package version changes or a compromised release is served, users may execute unexpected code during install, which is especially relevant because npx fetches and runs packages dynamically.
This line repeats the same unsafe pattern: invoking npx skills without pinning the CLI version. That creates a supply-chain exposure where the installed-and-executed code may differ over time or be attacker-controlled if the package namespace or release pipeline is compromised.
The command on this line relies on npx resolving skills at runtime with no exact version pin. Dynamic execution of unpinned tooling is dangerous because users may unknowingly run a newer, malicious, or compromised package version.
This is another instance of unpinned runtime package execution via npx skills. In the context of a skill file intended to be followed by agents or operators, this increases the chance of supply-chain compromise propagating into automated environments.
Because npx skills is not pinned, execution depends on whatever version is current at the time of use. That can lead to arbitrary code execution if the package or dependency chain is compromised, which is a real risk for command snippets embedded in operational guidance.
The full-suite installation command uses the same unpinned npx skills pattern, so it carries the same supply-chain risk as the prior lines. Since this is a convenience command likely to be copied verbatim, it is particularly likely to be executed without scrutiny.
This related-skill install command again instructs users to run npx skills without pinning the CLI version. Even though the target skill reference includes a package tag, the actual executable being fetched and run remains unpinned, preserving the attack surface.
This line has the same supply-chain weakness: dynamic execution of an unpinned CLI via npx. In a skill ecosystem where instructions may be reused by automation, this can amplify the blast radius of a compromised package release.
No suspicious patterns detected.
