Security audit
Security checks for vulnerabilities and agentic risk
The skill is marked suspicious because scanners report privacy risks from sharing footage through public URLs and an unpinned installer example; no malicious intent was established.
Before installing, consider whether you are comfortable with the reported public-link handling of footage. Avoid sending sensitive media through public URLs unless you have checked the receiving services and approved the exposure; also consider using an installer pinned to a reviewed version. The scan is partial: one local reference could not be resolved, so the evidence is incomplete.
The installation example uses an unpinned npx skills package, allowing executable code to change between installations. Although this is a CLI installer rather than an MCP server, a compromised future package release could execute with the installing user's permissions; there is no evidence of malicious intent in this source.
The workflow explicitly directs agents to upload footage and pass public URLs between services without a privacy check or specific authorization for external disclosure. Video editing legitimately uses hosted services, but footage can contain private conversations, identifiable people, or confidential material, and approval of a paid edit does not necessarily authorize public-link exposure.
The guide recommends uploading once and reusing a public media URL across hosted tools without addressing consent, access restrictions, or retention. This can expose confidential footage to additional providers and anyone obtaining the URL, even though cloud processing itself is relevant to the editing task.
