Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only video editing skill whose behavior matches its purpose, with install and overwrite caveats users should understand.
Reasonable to install if you are comfortable with local video-processing commands. Prefer pinned or reviewed skill/package versions where possible, avoid broad full-suite or --full-depth installs unless needed, and check output filenames before running ffmpeg examples that include -y.
The skill instructs users to execute npx skills add PrunaAI/pruna-skills@video-editing -y without pinning an immutable package version or digest. Because npx resolves and executes package code at install time, a future compromised or malicious package update could run attacker-controlled code on the user's system.
This install example uses npx skills add ... with a floating package reference rather than an immutable version. That exposes users to supply-chain risk because the resolved package contents can change over time and npx may execute those changed contents immediately.
The command references an external skill package through npx without a fixed version, enabling silent drift to newer package contents. In the event of account compromise, typosquatting, or malicious update publication, users could execute untrusted code during installation.
An unpinned npx skills install command permits execution of whatever package version is current at invocation time. This creates a classic supply-chain exposure where malicious or vulnerable updates can affect all future users following the documentation.
The documentation instructs use of npx with a non-immutable package reference. Since npx fetches and runs package code, any unauthorized upstream change could result in local code execution on systems using this skill.
This is a true supply-chain risk: the package reference is not pinned, so users may receive different code over time while believing they are following stable documentation. If the upstream package or dependency chain is compromised, installation could execute attacker code.
Using npx skills add without version pinning leaves the installation path dependent on mutable upstream state. That increases the risk of remote code execution via malicious package update, compromised maintainer account, or dependency hijack.
The skill recommends a floating npx install reference, which is dangerous because the package resolved in the future may not match the one originally reviewed. This is especially relevant for agent skills because installation commonly occurs in automation contexts with broad filesystem and network access.
This command invokes a remote package via npx without constraining the version, which creates avoidable supply-chain exposure. A compromised or malicious release could be installed and executed by anyone copying the documented command.
The install instruction is vulnerable to mutable upstream package changes because it does not pin a version. In practical terms, that can turn documentation into a remote code execution path if the package publisher or dependency chain is compromised.
An unpinned npx skills command exposes users to supply-chain compromise through future package drift. The risk is real even in benign documentation because users are being directed to execute externally hosted code directly from the command line.
The related-skill install command uses npx with a floating package reference, allowing package contents to change after the documentation is published. If that upstream package is tampered with, users could run untrusted code merely by following the instructions.
This npx skills add example is a true supply-chain weakness because it does not lock the installed package version. Agent-oriented tooling can amplify the danger, as installed code may run in environments with API keys, local files, or automation privileges.
The package install reference is mutable and therefore vulnerable to malicious upstream updates. Because npx commonly downloads and executes code immediately, the issue can lead directly to code execution rather than just functional inconsistency.
This documentation points users to execute an unpinned remote package via npx, which is a standard software supply-chain hazard. A malicious release or dependency hijack could compromise systems that trust and follow the command as written.
The install instruction lacks version pinning, so the exact code fetched by npx is not stable over time. This can enable remote code execution through compromised package publication and is therefore a genuine vulnerability in installation guidance.
A floating npx package reference makes the security of this skill depend on mutable upstream registry state. That is dangerous because a compromised package maintainer or malicious release could be executed by downstream users automatically.
The 'full suite' install command also uses an unpinned npx reference, increasing blast radius because it may install a broader set of packages. If exploited, this could execute attacker-controlled code and potentially introduce multiple compromised components into the environment.
The document instructs users to execute npx skills add heygen-com/hyperframes@hyperframes -y, which pulls and runs remote package/skill resolution logic without pinning a concrete immutable version. That creates a supply-chain risk: if the upstream package, tag, or transitive installer behavior changes or is compromised, users may execute unexpected code during installation.
The command npx skills add heygen-com/hyperframes --full-depth -y expands the risk by fetching a full bundle of remote skills without version pinning. Installing an entire dependency tree from a mutable remote source increases the attack surface and could introduce malicious or altered skills into the agent environment.
Repeating the unpinned npx skills add heygen-com/hyperframes@hyperframes -y guidance normalizes execution of mutable remote install commands in a security-sensitive agent workflow. In this context, skills can affect agent behavior and available tooling, so an upstream compromise could lead to unauthorized code execution or unsafe capability expansion.
The markdown instructs running ffmpeg with -y, which overwrites output files without prompting, but the surrounding text does not explicitly warn the user about that behavior. Because this is documentation for a command users may copy directly, a brief warning about overwrite behavior would improve safety.
Both example ffmpeg extraction commands include -y, which will replace audio_16k.wav if it already exists. The document does not warn the user that existing files may be overwritten, so the operation lacks user-facing disclosure for a destructive action.
The soft-subtitle example uses ffmpeg -y, which silently overwrites soft_subbed.mp4 if present, but the markdown does not call out this destructive behavior. Users following the instructions could lose a prior output file without realizing the command is non-interactive.
No suspicious patterns detected.
