Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent AI short-drama production workflow, but it includes an unscoped system package install command that users should review before use.
Install only if you are comfortable with a workflow that generates many local media files and may ask the agent to install ffmpeg at the system level. Prefer using it in a disposable or project-specific workspace, and require explicit approval before any apt-get command is run.
The manifest uses very broad trigger phrases such as 'drama', 'storyboard', and '短剧/剧本', which can cause the skill to activate for many ordinary creative requests. Over-broad activation is dangerous because this skill performs extensive file creation and multi-step media generation, so unintended invocation can lead to unnecessary tool use, workspace modification, and user confusion.
The skill explicitly instructs running apt-get update && apt-get install -y ffmpeg, which introduces system-level package installation during normal operation. Even though ffmpeg is relevant to video production, automatically directing an agent to modify the host environment increases attack surface, can fail unpredictably across environments, and may violate sandbox or least-privilege expectations.
The skill description and workflow do not prominently warn users that it will create many directories and write numerous intermediate and final files under output/. In context, the skill performs broad workspace mutations across six stages, so lack of upfront disclosure can lead to surprising side effects and accidental execution in sensitive or cluttered working directories.
No suspicious patterns detected.
