Security audit
Security checks for vulnerabilities and agentic risk
The skill provides a clearly scoped local video-editing workflow with human review before public use, with ordinary dependency-installation caveats.
Install Kinocut from its verified project source, preferably using a reviewed version in an isolated environment. Give it access to the intended video and output folder, and review rendered clips before sharing. The demo requires a separate repository checkout.
The supplied command modifies the local skill installation rather than processing video or producing reviewable clip packages. Although installation could support the described workflow, the supplied chunk only performs this undeclared setup operation. The contents and behavior of the copied skill are not shown and cannot be verified.
The MCP setup command leaves the Kinocut package version unspecified, allowing a fresh resolution to select an unreviewed release whose code runs with the host user's permissions. Installation is legitimate for this skill, but an upstream compromise or malicious release could expose local files or execute unintended actions; the skill's local-only workflow does not constrain malicious dependency code.
No suspicious patterns detected.
