Security audit

Recursive maths animator

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Manim animation skill with expected helper scripts, but users should be aware that cloud voiceover features can send narration text to third-party services.

Install only if you are comfortable with a Manim/ffmpeg Python workflow that writes project files and rendered media locally. Treat gTTS and Gemini voiceover as cloud features: do not use sensitive, proprietary, or regulated narration text unless you have reviewed the provider terms and data handling. Before using the copy-based skill installation command, check whether the destination already contains files you care about.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The code initializes GTTSService, which typically sends voiceover text to Google's text-to-speech infrastructure. Even though the current strings are hardcoded and low sensitivity, using an external service without disclosure or a local/offline option creates a real privacy and data-handling risk if future customizations include proprietary or sensitive narration text.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The README advertises auto-generated voiceover via GTTSService but does not disclose that narration text may be transmitted to an external third-party text-to-speech provider. This creates a privacy and data-handling risk because users may unknowingly send sensitive prompts, educational content, or proprietary material off-box when using the feature.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The document instructs users to recursively copy files into a system-wide Claude skills directory under the user's home folder without warning about overwriting existing content or verifying the destination state first. While not directly code execution, this can cause unintended replacement or modification of installed local skill files, leading to configuration drift, broken tooling, or accidental trust in altered skill contents.

Missing User Warnings

Medium

Confidence: 79% confidence
Finding: The method sends user-provided transcript text, scene descriptions, and sample context to a third-party cloud API, but the interface and method documentation do not clearly warn callers that this content leaves the local environment. In contexts where prompts may contain sensitive, proprietary, or regulated data, this can cause unintended data disclosure and compliance issues.

Static analysis

No suspicious patterns detected.