Security audit
Security checks for vulnerabilities and agentic risk
This is a Markdown-only short-video production workflow with some broad triggers and external media-service use, but no hidden code, persistence, credential use, or destructive behavior.
Before installing, be aware that using this skill may involve processing links, uploaded media, and generated assets through external stock-media or AI services. Avoid confidential or proprietary materials unless you have reviewed the tools being used, and verify copyright and platform-compliance claims before publishing.
The trigger list includes highly generic phrases such as '做视频', '生成视频', and 'video production', which can match ordinary user requests unrelated to this specialized skill. Overbroad activation can cause unintended invocation, exposing user prompts, links, or uploaded media to this workflow and any connected external services without clear user intent.
The keyword tables remain broad even after exclusions because many entries are category-level terms rather than precise commands, increasing the chance of accidental triggering. In this skill, unintended activation matters because the workflow explicitly accepts URLs, competitor video links, and uploaded assets that may then be processed or analyzed.
The skill solicits URLs, competitor links, and user-uploaded materials, and later references external asset sources and AI generation services, but it does not clearly warn users that these inputs may be transmitted to third parties for analysis or processing. This undermines informed consent and can lead to inadvertent disclosure of sensitive or proprietary media, campaign plans, or unpublished content.
The line “中文输出” imposes a fixed output language, while the rest of the skill supports multiple languages and does not state that Chinese-only output is required for compliance or region-specific use. This is a natural-language policy issue because it removes user language choice without opt-in or justification.
Line L047 states '需英文字幕或双语字幕' as a blanket requirement. This is a natural-language locale policy constraint that forces a specific language output without user opt-in or clarification that the workflow is limited to an English-speaking or international audience.
No suspicious patterns detected.
