Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed VFX media-generation workflow skill with normal output-file creation and explicit video confirmation gates.
Before installing, be aware that this skill may automatically generate 2-4 concept images and write outputs to /workspace/vfx-output when a VFX-material request matches its triggers. Video generation is explicitly gated on user choice, but users who only want advice or brainstorming should say so clearly.
The trigger phrase “制作特效素材” is broad enough to match ordinary creative requests, which can cause the skill to activate outside a clearly intended scope. Because this skill can initiate multi-step media-generation workflows and write outputs to workspace directories, overbroad activation increases the chance of unintended execution and user confusion about what actions will occur.
SQP-3 applies to all file types, including markdown instructions. This line states that Chinese requirements are converted into English MJ prompts as the default behavior, which imposes a language/locale constraint without offering the user a choice or documenting why English is mandatory.
The skill describes broad applicable scenarios but does not define exclusion conditions, boundaries, or non-goals, making activation decisions ambiguous. In practice this can cause the workflow to run in contexts where the user only wanted advice, brainstorming, or a partial task rather than automated generation steps.
No suspicious patterns detected.
