Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent educational video workflow, with the main caution that it asks users to install and use external Pruna generation skills through unpinned installer commands.
Install only if you trust the PrunaAI skill source and the `skills` CLI resolution path. Prefer pinned or otherwise vetted installer versions where possible, avoid the full-suite shortcut unless you need it, and confirm the plan, stills, and clips before any paid generation calls. Adjust voice, gender, and language defaults to fit the intended audience.
The skill instructs users to install and execute a package via npx skills add ... without pinning the skills tool itself to a specific version. This creates a supply-chain risk: a future or compromised release of the resolver/installer could change behavior or execute malicious code during installation.
This line references npx skills without pinning the executed tool version, so the behavior depends on whatever version is resolved at runtime. That exposes users to supply-chain compromise or unexpected breaking changes if the upstream package is replaced, hijacked, or updated maliciously.
The instruction runs npx skills without constraining the version of the tool being fetched and executed. In an agent skill ecosystem, that means a documentation consumer may execute unreviewed code from the registry, increasing supply-chain exposure.
Because npx skills is invoked without a fixed version, the command may pull and execute the latest available package at runtime. If the package or its dependency chain is compromised, users could run attacker-controlled code simply by following the skill instructions.
This is another unpinned npx skills invocation, which makes execution nondeterministic and vulnerable to upstream package tampering. The danger is amplified because the skill presents the command as a prerequisite, encouraging users or agents to run it before use.
The command relies on an unpinned npx-fetched tool, which can silently change over time or be replaced by a malicious release. That is a classic documentation-driven supply-chain weakness because users are encouraged to execute a mutable remote package.
This prerequisite command executes npx skills without version pinning, leaving consumers exposed to compromised or unexpected upstream code. The issue is not in the educational content itself but in the installation path the skill asks users to trust implicitly.
Using npx skills without a pinned version allows runtime resolution of whatever package is current, which undermines reproducibility and trust. A malicious publish or account takeover could convert this installation step into arbitrary code execution on the user's machine.
The 'install the full suite' shortcut still depends on an unpinned npx skills invocation, so users are exposed to the same mutable-execution risk at a larger scope. Installing a broad suite also increases blast radius if the bootstrap tool is compromised.
The markdown requires persona_gender to be female or male and says the Pruna voice must match that gender. This imposes a binary gender constraint in the skill's natural-language policy without offering user choice, alternatives, or a documented reason for the restriction.
The guidance states that character rows must include persona_gender and a matching character_descriptor, with voice chosen from gendered options (Zephyr / Puck). This is a natural-language policy constraint that forces a specific gender framework rather than allowing user preference or broader representation.
This related-skill installation command again uses npx skills without version pinning, preserving the same supply-chain weakness. Because it appears in a 'Related skills' section, readers may execute it casually without realizing they are running mutable remote code.
The command fetches and runs an unpinned skills tool via npx, which is vulnerable to upstream compromise or silent behavior changes. Even though the referenced package is a related skill, the security issue lies in the unpinned executable bootstrap path.
This final related-skill example still relies on floating npx skills resolution, which can lead to arbitrary code execution if the upstream package supply chain is compromised. Repetition across the file indicates a systemic documentation issue rather than a one-off mistake.
The install command uses npx skills add ... without pinning the exact package version or immutable source. That means the fetched package can change over time, and a compromised upstream release, hijacked tag, or dependency-chain attack could cause users to install and execute untrusted code.
This alternative install command also relies on npx with a non-pinned package reference, so the executed package contents may differ over time. If the package, tag, or one of its transitive dependencies is malicious or later compromised, users following the documentation could execute attacker-controlled code on their systems.
The skill hard-codes voice_language as English (US) in its cast schema, which can cause generated content to ignore the user's requested language or locale and produce misleading or exclusionary output. In an educational explainer workflow, this is a real quality/safety issue because it systematically reduces language choice and may create inaccessible or culturally mismatched content at scale.
The skill prescribes fixed English-named avatar voices and maps them by binary gender without any user language/locale opt-in, which can force output into an unintended language/voice profile and unnecessarily constrain identity representation. This is dangerous in an educational content generator because it bakes biased and locale-specific assumptions into reusable templates, leading to inaccessible or inappropriate output for non-English or differently localized users.
The file states to never use forms like "no", "avoid", "not", "without", "don't", or "do not" in creative fields. This is a natural-language constraint that forces a particular phrasing style and could conflict with user language preferences or normal expression, but the file does not present it as an optional mode or justified locale/policy requirement.
The config explicitly sets the character voice language to "English (US)". For a JSON template, this is a natural-language locale constraint, and there is no indication here that users can choose another language or that the locale restriction is justified as region-specific.
No suspicious patterns detected.
