Security audit
Security checks for vulnerabilities and agentic risk
The scanners returned a benign verdict with medium confidence: they found an unpinned `npx skills` installer and a possible disclosure gap around sending media to external services, while reporting no AIG findings; coverage was partial because a local reference could not be resolved.
The verdict is benign, but benign does not mean risk-free. Before installing, consider that the documented installer is unpinned and that media used in the video workflow may go to external services. Avoid submitting sensitive or identifiable media unless you are comfortable with that processing. The scan was partial because a local reference could not be resolved.
The installation example invokes an unpinned npm package through npx, allowing newly fetched package code to execute with the user's privileges. A compromised future release could therefore affect users following these instructions; this is an installation supply-chain risk, not an MCP-server reference as the finding claims.
This workflow step directs the use of real footage and character images with external motion-control or recasting services, rather than merely listing available tools. The warnings about owning or licensing footage address usage rights but do not disclose that the media will be sent to third-party services for processing.
