Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Media.io video-generation connector that sends user-provided prompts, image URLs, and an API key to Media.io when invoked.
Install only if you intend to use Media.io's external API. Keep the API key out of shared logs, shell history, and source control, and avoid sending confidential prompts, private image URLs, or sensitive task IDs unless you are comfortable with Media.io processing them.
This JSON manifest/documentation file shows that requests require an X-API-KEY authorization header, which involves transmitting credentials to an external endpoint. The file describes how to send the credential but does not include any warning about protecting the key, avoiding exposure in logs/history, or the fact that requests are sent to a remote service.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"description": "API to query user credits balance.",
"api_header": "{\"list\": [{\"name\": \"X-API-KEY\", \"value\": \"API key to authorize requests\"}, {\"name\": \"Content-Type\", \"value\": \"application/json\"}], \"title\": \"Authorizations\", \"describe\": \"Add the following authorization information in the request header\"}",
"api_body": "{\"title\": \"Request Body\", \"category\": [{\"list\": [], \"title\": \"Query Credits\", \"describe\": \"Request body to query user credits balance\"}]}",
"api_request_demo": "{\"title\": \"Example Request\", \"request\": [{\"title\": \"Query User Credits\", \"language\": \"cURL\", \"code_example\": \"curl --request POST \\n --url https://openapi.media.io/user/credits \\n --header 'Content-Type: application/json' \\n --header 'X-API-KEY: <api-key>' \\n --data '{}'\"}]}",
"api_response": "{\"list\": [{\"name\": \"code\", \"type\": \"integer\", \"describe\": \"Response status code, 0 indicates success\"}, {\"name\": \"msg\", \"type\": \"string\", \"describe\": \"Response message, empty string on success\"}, {\"name\": \"data\", \"type\": \"object\", \"describe\": \"Response data object\"}, {\"name\": \"credits\", \"type\": \"integer\", \"describe\": \"User credits balance, located within the data object\"}], \"title\": \"Response\", \"describe\": \"After the request is successfully processed, the server will return the following response\"}",
"api_code_demo": "{\"list\": [{\"code\": \"0\", \"describe\": \"Success\"}, {\"code\": \"40001\", \"describe\": \"Invalid API key\"}, {\"code\": \"40002\", \"describe\": \"API key expired\"}], \"title\": \"Status Code\"}",
"content": null,
The cURL example explicitly includes X-API-KEY: <api-key> and posts to https://openapi.media.io/user/credits, demonstrating external transmission of credentials. The surrounding documentation does not warn users that the request leaves the local environment or that shell examples may expose secrets in terminal history and logs.
These lines document an external POST request using X-API-KEY and a path parameter task_id, which may identify user jobs or outputs. The file explains how to make the request but provides no warning about remote transmission, credential handling, or possible exposure of identifiers in logs and command history.
This API documentation instructs users to send image URLs, prompts, and credentials to an external third-party service without any privacy or data-handling warning. In a skill context, that increases the risk users may unknowingly transfer sensitive media or confidential prompt content off-platform, leading to privacy, compliance, or data-governance issues.
The fast video-generation documentation similarly directs users to send external image URLs, prompts, and API credentials to a remote service with no disclosure about privacy or third-party processing. In practice, this can cause unintentional exfiltration of sensitive content or misuse of credentials if integrators treat the example as safe-by-default.
At L47, the request body marks "image" as a required parameter for the Google Veo 3.1 endpoint, making this an image-to-video API. However, the example request title at L48 says "create video by text or image," which contradicts the documented required input mode rather than merely omitting detail.
At L65, the request body marks "image" as a required parameter for the Google Veo 3.1 Fast endpoint, indicating image-to-video generation. The example request title at L66 says "create video by text or image," which actively conflicts with the documented required inputs.