Security audit

短视频生成-免费版

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed short-video production workflow that uses local rendering plus external image and voice services, with no evidence of hidden or destructive behavior.

Install only if you are comfortable running local Node/Remotion/FFmpeg commands and sending your video script or prompt content to third-party image and TTS providers. Review API key setup and confirm the agent is using it for short-video generation, not unrelated media tasks.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger condition is overly broad: requests involving video processing, audio editing, media conversion, or dubbing are common and may cause the skill to activate for unrelated user intents. In an agent with exec/write tools, accidental invocation can lead to unintended command execution, file creation, or transmission of user content to downstream services without clear user consent.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill workflow states that user scripts and material requests are sent to external image generation and TTS services, but the main usage guidance does not prominently warn users before processing begins. This creates a privacy and data-handling risk because potentially sensitive text, prompts, or creative materials may be disclosed to third parties without informed consent.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.