Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed AI media-generation workflow whose paid API use, local video assembly, and output files fit its stated purpose.
Before installing, use a trusted or pinned skills CLI rather than blindly running unpinned npx commands. Expect prompts, uploaded media, and generated outputs to be sent to Pruna or Replicate during generation, and choose a non-sensitive output directory because ffmpeg assembly overwrites the target MP4 after confirmation.
The skill instructs the agent to run npx skills add ... commands without pinning the version of the skills package itself. This creates a supply-chain risk: a future or maliciously replaced package/version of the CLI could execute unintended code during installation or alter behavior at runtime.
The documented use of npx skills add ... relies on an unpinned skills executable, which may resolve to different code over time. In an agentic workflow, that exposes the environment to remote code execution or tampered dependency installation if the upstream package is compromised.
This installation instruction invokes an unpinned npx skills command, which is a classic software supply-chain weakness. Because npx may fetch and execute code dynamically, a compromised or changed package could run arbitrary code in the user's environment.
Using npx skills without pinning the CLI version makes the installation path non-reproducible and trust-dependent on the latest upstream package state. If the package or namespace is hijacked, the skill could cause execution of malicious code during setup.
The skill references npx skills as part of dependency installation without fixing the CLI version. That leaves consumers exposed to upstream changes or package compromise, which is particularly risky because npx executes retrieved code.
This is a true supply-chain issue because the skill normalizes executing an unpinned npx command to acquire tooling. In a compromised registry or namespace takeover scenario, an attacker could gain code execution during installation.
The command pattern uses npx skills without constraining which exact package version is executed. This broad trust in upstream package resolution can lead to arbitrary code execution if the package is maliciously updated or substituted.
The 'install the full suite' instruction still depends on bare npx skills, preserving the same supply-chain exposure as the per-skill install commands. The risk is amplified because it is positioned as a convenient default path likely to be copied verbatim.
The related-skills section repeats the same unpinned npx skills installer pattern, which perpetuates the supply-chain risk throughout the document. Repetition increases the likelihood that an operator or agent will execute one of these commands without scrutiny.
This line instructs installation through an unversioned npx skills command, allowing runtime resolution of whatever package currently answers that name. That is dangerous in agent environments because package retrieval and execution happen in one step.
The skill continues to reference npx skills without pinning, which is a true vulnerability rather than a harmless documentation issue because the command is executable setup guidance. A compromised package could alter installed skills, exfiltrate secrets, or run arbitrary commands.
By recommending unpinned npx execution, the document exposes users to changes outside their control and undermines reproducibility. In practice, this can become a code execution vector if the package ecosystem entry is hijacked or updated maliciously.
The same unpinned installer pattern appears here, preserving the possibility of malicious code execution via package resolution. The surrounding skill context includes credentials and local media processing, so compromise could expose tokens or sensitive project data.
This related install command again relies on a non-pinned npx skills invocation. Because the skill handles paid APIs and local subprocess orchestration, successful supply-chain compromise could have broader downstream effects than a simple failed install.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Pruna P-API (stills + optional motion)
- Base: `https://api.pruna.ai/v1/predictions`
- Upload: `https://api.pruna.ai/v1/files`
- Header: `apikey: ${PRUNA_API_KEY}`, `Model: p-image` | `p-image-ideogram` | `p-image-edit` | `p-video-2` | `p-video`
- Body: `{ "input": { ... } }`
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Pruna P-API (stills + optional motion)
- Base: `https://api.pruna.ai/v1/predictions`
- Upload: `https://api.pruna.ai/v1/files`
- Header: `apikey: ${PRUNA_API_KEY}`, `Model: p-image` | `p-image-ideogram` | `p-image-edit` | `p-video-2` | `p-video`
- Body: `{ "input": { ... } }`
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Replicate (audio)
- Header: `Authorization: Bearer ${REPLICATE_API_TOKEN}`
- Create: `POST https://api.replicate.com/v1/models/{owner}/{name}/predictions`
- Poll `urls.get` until `succeeded`; download output URL.
**Models in this workflow:**
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Before assembly:
> Assembly runs ffmpeg into `{out_dir}/story_reel.mp4`. ffmpeg uses **`-y`** and overwrites the output path without confirmation — confirm `{out_dir}` is correct.
## Phases (agent)
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Before assembly:
> Assembly runs ffmpeg into `{out_dir}/story_reel.mp4`. ffmpeg uses **`-y`** and overwrites the output path without confirmation — confirm `{out_dir}` is correct.
## Phases (agent)
This JSON manifest sets "language_code" to "en-US", which is natural-language configuration that forces a specific language/locale. The file does not indicate that the locale is optional, user-selectable, or justified as region-specific, so it may violate language/locale policy guidance.
No suspicious patterns detected.