Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward guide for turning media into text with external multimodal models, with no hidden code, persistence, or privilege escalation found.
Before installing, treat this as a media-processing skill that may send images, documents, audio, or video to external model providers. Avoid using it on highly sensitive IDs, medical records, financial documents, private recordings, or confidential screenshots unless that disclosure is acceptable.
The trigger phrase "Any media in, text out task" is so broad that it can cause the skill to be invoked for many unrelated or sensitive workflows, including documents, screenshots, receipts, IDs, and private audio/video. Over-broad routing increases the chance of accidental exfiltration of sensitive user content to external multimodal providers without clear user awareness or narrower task gating.
The skill instructs collection of media as a URL or base64 but does not warn that this content may be transmitted to external model providers, which can include highly sensitive images, documents, audio, or video. Users or calling agents may unknowingly pass private data such as receipts, screenshots, IDs, or conversations to third-party endpoints, creating confidentiality and compliance risk.
No suspicious patterns detected.
