Security audit
Security checks for vulnerabilities and agentic risk
The skill appears purpose-built for Pruna avatar-video generation, but it asks agents to run unpinned skill-install commands and sends portrait/audio/script data to an external API.
Review before installing. Only use this skill if you are comfortable sending the portrait, narration audio, script, prompts, and PRUNA_API_KEY to Pruna. Do not let an agent run the `npx skills add ... -y` commands automatically unless you trust the source and have pinned or otherwise verified the versions you intend to install.
The skill instructs the agent to execute npx skills add ... commands without pinning an exact immutable version. That allows whatever package version is current at execution time to be fetched and run, creating a supply-chain risk if a dependency is updated maliciously or unexpectedly.
This line references npx skills without an exact pinned version, so the executed code may vary over time. In agent workflows, unpinned package execution is risky because it can silently introduce malicious or incompatible behavior from the registry.
Running npx skills from an unpinned package source exposes the environment to remote code that can change between runs. This is a classic supply-chain exposure, especially dangerous for automated agents that may execute installation instructions directly.
The instruction depends on npx skills without fixing the package version, making the code path non-deterministic and susceptible to registry compromise or malicious updates. Agents following this literally could execute attacker-controlled code.
This installation shortcut still relies on an unpinned npx skills invocation. Even if the skill package name includes a version-like suffix, the executable itself remains mutable unless the tool package is explicitly pinned.
The skill recommends another npx skills install path without pinning an exact immutable version of the executed tool. That introduces avoidable supply-chain risk in an agent environment that may follow embedded shell commands.
This unpinned package execution path can fetch and run different code over time. In practice, that means a later registry update or compromise could turn benign install instructions into arbitrary code execution.
The line exposes the agent to mutable remote code because npx skills is not pinned. Documentation that embeds executable install commands should be treated as security-sensitive in agentic systems.
Because the npx skills executable is not version-locked, the actual code executed is not stable or auditable. This weakens reproducibility and opens a path for malicious package substitution or compromised releases.
This is another floating install instruction that can cause an agent to run unreviewed third-party code. The risk is contextualized by the fact that the skill explicitly tells the agent to install dependencies before generation.
The skill points to npx skills without an immutable version, leaving the execution path vulnerable to upstream changes. In agent automation, that can lead to silent compromise via the package registry or dependency chain.
This installation reference is a true supply-chain concern because the agent may execute a mutable package directly from the network. The absence of version pinning makes later malicious or breaking changes automatically inherited.
Another unpinned npx skills invocation appears in the skill-selection guidance. Since agent skills are operational instructions, embedding mutable package execution is risky and should be treated as a real vulnerability.
The skill directs uploading a local portrait file and API key-authenticated content to an external service. This is a real data-exfiltration boundary because sensitive user media and credentials are sent off-platform, and portrait images are biometric/personal data that deserve explicit consent and handling controls.
curl -X POST "https://api.pruna.ai/v1/files" \
-H "apikey: ${PRUNA_API_KEY}" \
-F "content=@/path/to/portrait.png"
The skill directs uploading a local portrait file and API key-authenticated content to an external service. This is a real data-exfiltration boundary because sensitive user media and credentials are sent off-platform, and portrait images are biometric/personal data that deserve explicit consent and handling controls.
curl -X POST "https://api.pruna.ai/v1/files" \
-H "apikey: ${PRUNA_API_KEY}" \
-F "content=@/path/to/portrait.png"
This line initiates an external API prediction request that sends user-provided prompts, scripts, and media references to a third-party service. In context, that is expected functionality, but it still represents external transmission of potentially sensitive content and should be treated as a real data-sharing risk requiring disclosure and approval.
curl -X POST 'https://api.pruna.ai/v1/predictions' \
-H 'Content-Type: application/json' \
-H "apikey: ${PRUNA_API_KEY}" \
-H 'Model: p-video-avatar' \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
-H 'Model: p-video-avatar' \
-d '{
"input": {
"image": "https://api.pruna.ai/v1/files/FILE_ID",
"voice_script": "Hey — so we shipped something I've wanted for a while.",
"voice": "Puck (Male)",
"voice_language": "English (US)",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
-H 'Model: p-video-avatar' \
-d '{
"input": {
"image": "https://api.pruna.ai/v1/files/FILE_ID",
"voice_script": "Hey — so we shipped something I've wanted for a while.",
"voice": "Puck (Male)",
"voice_language": "English (US)",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
-H 'Model: p-video-avatar' \
-d '{
"input": {
"image": "https://api.pruna.ai/v1/files/FILE_ID",
"voice_script": "Hey — so we shipped something I've wanted for a while.",
"voice": "Puck (Male)",
"voice_language": "English (US)",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
-H 'Model: p-video-avatar' \
-d '{
"input": {
"image": "https://api.pruna.ai/v1/files/FILE_ID",
"voice_script": "Hey — so we shipped something I've wanted for a while.",
"voice": "Puck (Male)",
"voice_language": "English (US)",
The sync prediction call transmits user content to an external service and may do so immediately in a blocking manner. Although aligned with the skill's purpose, the operation crosses a trust boundary and could expose sensitive scripts, voices, or linked media if used without explicit approval.
curl -X POST 'https://api.pruna.ai/v1/predictions' \
-H 'Content-Type: application/json' \
-H "apikey: ${PRUNA_API_KEY}" \
-H 'Model: p-video-avatar' \
This instruction expands the external transmission scope by involving uploaded narration audio in addition to portrait imagery. Audio can contain sensitive biometric and personal information, so sending it to a third party raises meaningful privacy and compliance concerns even if it is core functionality.
Generate gemini-3.1-flash-tts → upload to /v1/files. Pass as input.audio with portrait image. If both audio and voice_script are set, audio wins.
curl -X POST 'https://api.pruna.ai/v1/predictions' \
-H 'Content-Type: application/json' \
-H "apikey: ${PRUNA_API_KEY}" \
-H 'Model: p-video-avatar' \
This follow-on skill install command again uses an unpinned npx skills reference. It creates the same remote code execution and supply-chain exposure as the earlier installation examples.
The line instructs unpinned package execution, which is unsafe in automated environments. If the referenced tool or its dependencies are compromised, the agent could execute attacker-controlled code.
This is a true vulnerability because it relies on mutable package resolution through npx. In a skill file meant to guide agent behavior, that significantly increases the chance of unsafe execution of third-party code.
No suspicious patterns detected.