Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed video-reel workflow that uses media-generation skills and ffmpeg, with visible local file output and external media upload steps, but its install examples should be treated cautiously because they are not version-pinned.
Before installing, review the PrunaAI skill source and prefer pinned versions or a trusted installer. When using the skill, expect generated/reference media to be uploaded to the provider tools it invokes and expect local output files such as stills, clips, and reel.mp4 to be created or overwritten in the chosen workspace.
The skill instructs users to run npx skills add ... commands without pinning the skills CLI itself to a specific version. Because npx resolves the latest published package by default, a compromised or breaking upstream release could execute unexpected code on the operator's machine during installation.
This line references npx skills without a pinned CLI version, which creates a supply-chain risk at execution time. An attacker controlling or hijacking the resolved package/version could cause arbitrary code execution when the user follows the documented install command.
Using npx skills unpinned means the actual code run is not stable or auditable over time. In a skill that repeatedly tells operators to install auxiliary components, this increases exposure to malicious package updates or dependency substitution.
The install command relies on npx to fetch and execute an unpinned package, which is a recognized software supply-chain weakness. If the package or one of its dependencies is compromised, following the skill documentation can lead to arbitrary local code execution.
This unpinned npx skills invocation allows changing remote code to be executed whenever a user follows the instructions. Because the skill is operational guidance, the risk is practical: users may directly run the command in a trusted shell context.
A bare npx skills command delegates execution to whatever version is current at runtime, making the install path mutable and vulnerable to upstream compromise. This is dangerous because npx packages can execute lifecycle scripts and arbitrary installer logic.
The skill asks the operator to run another unpinned npx skills command, perpetuating the same remote-code execution supply-chain exposure. Repetition across many prerequisite lines increases the attack surface and the chance the user follows at least one risky command.
This line again uses unpinned npx skills, enabling mutable code execution from the npm ecosystem. In the context of an agent skill, these commands may be treated as routine setup, which can reduce user scrutiny and make exploitation more likely.
The 'install the full suite once' command uses unpinned npx skills, so a single copied command could execute attacker-controlled code if the upstream package is compromised. This is especially sensitive because it encourages broad installation of a suite, expanding trust in one step.
The redirect/install guidance still relies on unpinned npx skills, preserving the same supply-chain execution risk. A user switching to an alternate skill based on this recommendation may unknowingly execute mutable remote code.
This installation example executes an unpinned package via npx, creating a path for arbitrary code execution from a compromised upstream release. The risk is not mitigated by the command being documentation; documentation often becomes copy-paste execution.
The skill continues to present mutable npx skills commands for related tooling. In aggregate, these references normalize unsafe installation behavior and broaden the chance of supply-chain compromise affecting the operator environment.
The related-skills section includes another unpinned npx skills command, exposing users to the same latest-version execution risk. Because this is a dependency-adjacent recommendation, it can still lead directly to local code execution if followed.
This npx skills invocation is not reproducible and can resolve to different code over time, which is a supply-chain hazard. If the package namespace or dependency tree is compromised, users may execute malicious setup logic simply by following the skill.
The command again executes an unpinned npm-delivered tool, which can be silently altered by future releases or package compromise. In agent-skill ecosystems, such setup commands are especially risky because users may assume they are endorsed and safe to paste.
This final related install command repeats the unpinned npx skills pattern and therefore the same supply-chain risk. The cumulative context makes the file more dangerous because it repeatedly directs shell execution across multiple packages and workflows.
The documentation instructs users to run npx skills add ... without pinning an exact package version, which can fetch whatever code is current at execution time. If the upstream package is compromised or a malicious update is published, users may install and execute unreviewed code through their toolchain.
This alternate install command also uses npx skills add ... with a floating package reference rather than an exact pinned version. That increases supply-chain risk because users may execute newly published code that has not been validated with this skill documentation.
This markdown instructs the agent to run ffmpeg -y commands that extract frames and write output files such as stills/02_from_prev.png and reel.mp4. While the operations are part of assembly, the skill description does not explicitly warn the user that local files will be created or overwritten during processing.
No suspicious patterns detected.
