Security audit
Security checks for vulnerabilities and agentic risk
This skill coherently creates short videos from your footage, with a routine dependency risk in its command-line fallback.
Choose only the footage folders you want indexed, review Reelary's setup before installing, and prefer a reviewed, pinned CLI version. The downloaded package and application are outside this artifact inspection.
The fallback cut command uses npx -y reelary without a version, allowing npm to fetch and execute a mutable package release without an installation confirmation. A compromised future release could execute code with the agent's local permissions and access footage or other accessible files; this is a CLI supply-chain risk, not an MCP server configuration issue.
The fallback export command independently repeats the unversioned npx -y reelary invocation, exposing execution to a mutable npm release with no installation confirmation. Although exporting video is legitimate, a compromised dependency could run arbitrary code under the agent's account; this repeats the same supply-chain weakness as the cut command rather than demonstrating a separate attack mechanism.
No suspicious patterns detected.
