Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly prompt guidance, but it includes video/avatar API workflows outside its still-image framing and unpinned install commands, so users should review it before installing.
Install only if you are comfortable with a skill that goes beyond still-image prompt writing into Pruna avatar/video examples. Review the related-skill installs before running them, prefer pinned versions where possible, and treat the curl examples as paid external API calls that may send prompts, image URLs, and voice text to Pruna.
The skill instructs users to execute npx skills add ... without pinning an exact package version or commit. This creates a supply-chain risk because future package updates or a compromised upstream release could change what gets installed and executed, and the command is presented as a copy-paste installation step inside a trusted skill document.
This installation command uses npx skills add ... with a mutable package reference rather than an exact pinned version. If the upstream package or tag is modified, users may fetch and run different code than intended, enabling supply-chain compromise through a trusted workflow.
The skill recommends npx skills add ... for installing another package without pinning an exact version. Because npx resolves and executes package content dynamically, an attacker controlling or compromising the upstream package distribution could introduce malicious code into the user's environment.
This line contains an unpinned npx skills add ... install instruction, exposing users to upstream package drift and possible malicious package replacement. In a skill file, such commands are likely to be copied verbatim, which increases the practical risk of supply-chain abuse.
The command references a package through npx without an immutable version pin. If the remote package changes or is hijacked, the documented setup process can silently deliver attacker-controlled code to users who trust the skill documentation.
This is another copy-pasteable npx skills add ... command with no exact version pinning. The security issue is not the image-prompting content itself but the trust boundary crossing into remote package execution through mutable package metadata.
The skill lists an installation command that resolves package code at runtime without exact pinning. In the event of package compromise, typo-squatting, or malicious update publication, users could execute unintended code simply by following the documentation.
This unpinned npx skills add ... command exposes consumers to package substitution and malicious release risks. Because the skill is a distribution and onboarding document, it can propagate unsafe installation practices at scale even if there is no evidence of malicious author intent.
The package install reference is mutable and executed via npx, so the code fetched in the future may differ from what the author originally tested. That makes the documentation an avenue for supply-chain attacks against anyone following the command.
This line repeats the same insecure installation pattern: dynamic remote package execution through npx with no exact version pin. A compromised upstream release could lead to arbitrary code execution in the user's environment under the guise of routine skill installation.
The install command is not reproducible because it depends on a mutable upstream package reference. That creates a genuine supply-chain vulnerability: trusted documentation can direct users to execute future malicious code if the package or distribution channel is compromised.
This npx skills add ... example lacks exact version pinning, making the installed code dependent on the current state of the upstream registry. In practice, that weakens user defenses against package hijacking and malicious updates because the command appears authoritative within the skill.
The full-suite install command also uses an unpinned package target, so it inherits the same supply-chain exposure as the other examples. Its broader scope may increase blast radius because a compromised suite package could introduce multiple malicious capabilities at once.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
p-image) — avatar-readycurl -X POST 'https://api.pruna.ai/v1/predictions' \
-H 'Content-Type: application/json' -H "apikey: ${PRUNA_API_KEY}" \
-H 'Model: p-image' \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
p-image) — avatar-readycurl -X POST 'https://api.pruna.ai/v1/predictions' \
-H 'Content-Type: application/json' -H "apikey: ${PRUNA_API_KEY}" \
-H 'Model: p-image' \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
p-image) — avatar-readycurl -X POST 'https://api.pruna.ai/v1/predictions' \
-H 'Content-Type: application/json' -H "apikey: ${PRUNA_API_KEY}" \
-H 'Model: p-image' \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
p-image) — avatar-readycurl -X POST 'https://api.pruna.ai/v1/predictions' \
-H 'Content-Type: application/json' -H "apikey: ${PRUNA_API_KEY}" \
-H 'Model: p-image' \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
p-image) — avatar-readycurl -X POST 'https://api.pruna.ai/v1/predictions' \
-H 'Content-Type: application/json' -H "apikey: ${PRUNA_API_KEY}" \
-H 'Model: p-image' \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
p-image) — avatar-readycurl -X POST 'https://api.pruna.ai/v1/predictions' \
-H 'Content-Type: application/json' -H "apikey: ${PRUNA_API_KEY}" \
-H 'Model: p-image' \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
p-image) — avatar-readycurl -X POST 'https://api.pruna.ai/v1/predictions' \
-H 'Content-Type: application/json' -H "apikey: ${PRUNA_API_KEY}" \
-H 'Model: p-image' \
-d '{
The markdown includes a natural-language configuration value voice_language: "English (US)" for avatar generation, which imposes a specific locale. The file does not indicate that this is optional, user-selected, or required for a region-specific purpose, so it conflicts with the policy against forcing a language/locale without opt-in.
This example again specifies voice_language: "English (US)" as a fixed setting. Because the file presents this as a default example without offering alternatives or explaining a justified locale restriction, it constitutes a natural-language locale policy violation.
The file materially expands the skill from still-image prompting into try-on and video-avatar generation workflows, creating scope drift between the declared skill purpose and the actual instructions. This can cause an agent to invoke or guide higher-risk capabilities than expected, weakening least-privilege boundaries and making downstream misuse or policy bypass more likely.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
## Why this exists
Current public examples often read as **AI sloppy** or **too simplistic**: same neutral wall, same face, same medium close-up, one photoreal look, brochure VO. The stack can deliver **editorial fashion**, **complex wardrobe**, **cel-anime hosts**, **documentary street portraits**, and **talking heads with distinct motion** when scenarios are planned as a matrix — not one template repeated.
## Pipeline overview
These sections provide operational guidance for p-video-avatar, including voice, motion, and multi-scene clip planning, which is outside the stated still-image-only skill scope. In an agent environment, that mismatch can enable unauthorized capability expansion and cause tools or workflows to be used in ways the operator did not intend to permit.
No suspicious patterns detected.