Security audit
Security checks for vulnerabilities and agentic risk
The skill is coherent for Pruna video generation, but it asks the agent to install multiple mutable helper skills and send user prompts or media to Pruna's API.
Install only if you trust the PrunaAI/pruna-skills source and are comfortable with helper skills being added to the agent. Avoid sending confidential prompts, private images, or sensitive media unless your Pruna account and data-handling expectations allow it, and prefer pinned or pre-reviewed skill versions where possible.
The skill instructs the agent to install and execute additional skills via npx skills add ... using moving package references rather than immutable, pinned versions. This creates a supply-chain risk: if the upstream package or tag changes, a future run could fetch and execute unexpected code or altered prompts with the agent's privileges.
This line references an external skill installation through npx skills add without an immutable version boundary. Because skill content is executable guidance for the agent, an upstream change could silently alter behavior and introduce prompt injection, unsafe actions, or credential-handling changes.
The skill depends on another skill fetched at runtime via an unpinned npx skills reference. That means trust is delegated to whatever package content is current at execution time, which is a classic supply-chain weakness for agent systems.
The line directs installation of pruna-api through npx skills add without a pinned immutable version. Since this dependency influences HTTP calls and credential use, a malicious or compromised update could affect sensitive outbound requests or exfiltrate API keys.
The full-suite installation command uses a floating package reference, expanding the trust boundary to a larger set of remotely controlled skills. A compromised or changed upstream suite could introduce unsafe behavior across multiple capabilities at once.
This alternate-skill recommendation also uses an unpinned runtime install command. Even though it is presented as guidance, agent frameworks may follow these instructions automatically, making the floating dependency a real supply-chain exposure.
The skill recommends another package through npx skills add without a fixed version, allowing upstream content drift. In agent contexts, this can change behavior over time without local code changes or review.
This line exposes the same supply-chain issue: a remote skill may be fetched and trusted based on a mutable tag or latest resolution. If compromised, it could alter prompts, cause unauthorized tool use, or manipulate outputs.
The npx skills reference is unpinned and therefore subject to package substitution or malicious updates. Because the referenced skill affects talking-head generation routing, altered content could still influence downstream API use and user data handling.
An unpinned recommendation for another skill creates a runtime dependency on mutable external content. In agent systems, even non-code markdown instructions can meaningfully change execution paths and safety boundaries.
This install guidance is vulnerable to upstream tampering because it does not lock the dependency to a specific immutable artifact. If exploited, an attacker could influence generation workflows or trigger unauthorized follow-on actions.
The line recommends fetching p-video-replace using a floating reference, which is a supply-chain risk in a tool-executing environment. Remote content drift can convert benign routing guidance into harmful instructions over time.
This npx skills command remains unpinned and therefore trusts mutable upstream content. Because the referenced skill may lead to additional editing or processing actions, a compromised package could widen downstream impact.
The skill explicitly instructs uploading local files to an external API endpoint, which is a real data egress path. While this is expected for a video-generation skill, it is still security-relevant because users may provide sensitive images and the agent is told to transmit them off-platform using an API key.
curl -X POST "https://api.pruna.ai/v1/files" \
-H "apikey: ${PRUNA_API_KEY}" \
-F "content=@/path/to/first-frame.png"
The skill explicitly instructs uploading local files to an external API endpoint, which is a real data egress path. While this is expected for a video-generation skill, it is still security-relevant because users may provide sensitive images and the agent is told to transmit them off-platform using an API key.
curl -X POST "https://api.pruna.ai/v1/files" \
-H "apikey: ${PRUNA_API_KEY}" \
-F "content=@/path/to/first-frame.png"
The async create example instructs sending prompts and generation parameters to an external API over the network. This is intended behavior for the skill, but it still constitutes a true external transmission risk because potentially sensitive user inputs leave the local trust boundary.
curl -X POST 'https://api.pruna.ai/v1/predictions' \
-H 'Content-Type: application/json' \
-H "apikey: ${PRUNA_API_KEY}" \
-H 'Model: p-video-2-pro' \
This example sends prompts and referenced image URLs to an external prediction API, creating intentional outbound data flow. In context that is core functionality, but it remains a true exposure because prompts can contain proprietary creative briefs or sensitive content and are shared with a third party.
curl -X POST 'https://api.pruna.ai/v1/predictions' \
-H 'Content-Type: application/json' \
-H "apikey: ${PRUNA_API_KEY}" \
-H 'Model: p-video-2-pro' \
This example sends prompts and referenced image URLs to an external prediction API, creating intentional outbound data flow. In context that is core functionality, but it remains a true exposure because prompts can contain proprietary creative briefs or sensitive content and are shared with a third party.
curl -X POST 'https://api.pruna.ai/v1/predictions' \
-H 'Content-Type: application/json' \
-H "apikey: ${PRUNA_API_KEY}" \
-H 'Model: p-video-2-pro' \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
-d '{
"input": {
"prompt": "The camera slowly pushes in, the person turns their head and smiles",
"image": "https://api.pruna.ai/v1/files/FIRST_ID",
"duration": 5,
"resolution": "768p"
}
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
-d '{
"input": {
"prompt": "The camera slowly pushes in, the person turns their head and smiles",
"image": "https://api.pruna.ai/v1/files/FIRST_ID",
"duration": 5,
"resolution": "768p"
}
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
-d '{
"input": {
"prompt": "The camera slowly pushes in, the person turns their head and smiles",
"image": "https://api.pruna.ai/v1/files/FIRST_ID",
"duration": 5,
"resolution": "768p"
}
This example sends prompts plus first/last frame references to an external prediction API, which is a genuine off-platform data disclosure path. The context makes it expected rather than malicious, but frame anchors may contain sensitive or proprietary visuals, so the egress risk is material.
curl -X POST 'https://api.pruna.ai/v1/predictions' \
-H 'Content-Type: application/json' \
-H "apikey: ${PRUNA_API_KEY}" \
-H 'Model: p-video-2-pro' \
The sync test example instructs sending generation requests to a third-party API, which is a real network egress path. Although normal for the feature, this still matters because prompts and parameters may reveal sensitive user intent and the API key authorizes billable external actions.
curl -X POST 'https://api.pruna.ai/v1/predictions' \
-H 'Content-Type: application/json' \
-H "apikey: ${PRUNA_API_KEY}" \
-H 'Model: p-video-2-pro' \
The related-skills section again instructs installation through an unpinned package reference. Repetition increases exposure because multiple execution paths may independently trigger unsafe runtime fetches.
This is another true supply-chain issue: the skill advertises loading external content without pinning. Mutable upstream dependencies are especially risky for agent ecosystems where instructions directly drive privileged behavior.