Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly a disclosed Pruna video-generation guide, but it asks agents to install multiple additional skills through unpinned remote commands and has conflicting scope around audio, 1080p, and draft modes.
Review the install commands before use, prefer a pinned or trusted installation path for any prerequisite skills, and do not let an agent auto-run the npx commands unattended. Also confirm whether your request should use p-video or p-video-2 when it involves imported audio, 1080p, or draft previews, and avoid uploading sensitive media unless you are comfortable sending it to Pruna's API.
The manifest description excludes 'imported audio at 1080p' as a use case, implying a narrower scope. However, the skill documentation later allows an audio input, resolution of 1080p, and even provides guidance for audio-conditioned generation, so the documented behavior is broader than the manifest claim.
The skill instructs agents/users to invoke npx skills add ... repeatedly without pinning the skills tool itself to an immutable version. Unpinned bootstrap tooling creates a supply-chain risk: a future or compromised release of the CLI could execute unexpected code during installation and affect any environment following these instructions.
This line again relies on npx skills add ... without an immutable version for the skills runner. Because npx may fetch and execute the latest matching package, an attacker controlling or compromising that package path could gain code execution in the caller's environment.
The installation example invokes mutable bootstrap tooling via npx skills, which is a classic supply-chain exposure. In an agent setting, this is more dangerous because the instruction is framed as a prerequisite, encouraging automatic execution before the main task.
The skill references npx skills as a prerequisite command without pinning the bootstrap package version. That leaves consumers exposed to arbitrary upstream changes or compromise of the package used to resolve skills at runtime.
Using npx skills add ... for the suite install still depends on an unpinned skills executor. Even though the target suite is versioned, the bootstrap binary performing the install remains mutable and could be abused for code execution or dependency substitution.
The 'Out of scope' section explicitly routes '1080p, imported audio, or draft previews' to p-video-2. Yet the same file later documents audio as a common optional field, resolution as 720p or 1080p, and provides an example using audio, creating a direct contradiction in the skill's own instructions.
This alternate-skill recommendation again tells users to run npx skills add ... through an unpinned skills tool. Repetition across routing sections increases the chance that agents or operators will execute mutable package-manager commands from the skill without review.
The document continues to recommend unpinned npx skills usage for another skill path. This exposes downstream users to the same supply-chain and arbitrary-code-execution risk inherent in fetching the latest bootstrap package at execution time.
This line repeats the same unpinned npx skills add pattern. In security-sensitive automation, mutable installer invocations are dangerous because they let upstream package changes alter behavior long after the skill was reviewed.
Another unpinned npx skills invocation appears in the replacement-skill table. The context makes it operationally relevant because users are explicitly told to install tools from these commands, not merely shown inert syntax.
The skill references npx skills again without pinning the bootstrap package. This creates a preventable supply-chain exposure where compromised or unexpected package resolution can lead to execution of unreviewed code.
This is another true positive for mutable bootstrap tooling. Because it appears in a 'use a different skill instead' section, it broadens the attack surface to multiple alternative packages that may be installed on demand.
The line instructs use of npx skills add without a fixed skills version. Any compromise of the package resolution path can propagate to consumers as remote code execution during environment setup.
The same unpinned installer pattern occurs here as well. In aggregate, the document normalizes executing remote package-manager commands directly from documentation, which increases the practical exploitation likelihood.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST "https://api.pruna.ai/v1/files" \
-H "apikey: ${PRUNA_API_KEY}" \
-F "content=@/path/to/first-frame.png"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST "https://api.pruna.ai/v1/files" \
-H "apikey: ${PRUNA_API_KEY}" \
-F "content=@/path/to/first-frame.png"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST "https://api.pruna.ai/v1/files" \
-H "apikey: ${PRUNA_API_KEY}" \
-F "content=@/path/to/first-frame.png"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST "https://api.pruna.ai/v1/files" \
-H "apikey: ${PRUNA_API_KEY}" \
-F "content=@/path/to/first-frame.png"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST "https://api.pruna.ai/v1/files" \
-H "apikey: ${PRUNA_API_KEY}" \
-F "content=@/path/to/first-frame.png"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST "https://api.pruna.ai/v1/files" \
-H "apikey: ${PRUNA_API_KEY}" \
-F "content=@/path/to/first-frame.png"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST "https://api.pruna.ai/v1/files" \
-H "apikey: ${PRUNA_API_KEY}" \
-F "content=@/path/to/first-frame.png"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST "https://api.pruna.ai/v1/files" \
-H "apikey: ${PRUNA_API_KEY}" \
-F "content=@/path/to/first-frame.png"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST "https://api.pruna.ai/v1/files" \
-H "apikey: ${PRUNA_API_KEY}" \
-F "content=@/path/to/first-frame.png"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST "https://api.pruna.ai/v1/files" \
-H "apikey: ${PRUNA_API_KEY}" \
-F "content=@/path/to/first-frame.png"
No suspicious patterns detected.