Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Xplai video-generation integration, with some privacy and routing caveats but no evidence of deception, persistence, or destructive behavior.
Install only if you are comfortable sending video descriptions, optional image URLs, and video IDs to Xplai's external API. Avoid using it with confidential business material, private images, secrets, or internal URLs, and avoid enabling debug mode when prompts or responses may be sensitive.
A second mismatch is that the skill claims full multilingual video generation from user ideas, but the analyzed behavior appears limited to status retrieval or other narrower remote API interactions. This can mislead routing logic into sending unrelated prompts or user data to a tool that does not actually satisfy the requested function, increasing privacy and integrity risks.
A second mismatch is that the skill claims full multilingual video generation from user ideas, but the analyzed behavior appears limited to status retrieval or other narrower remote API interactions. This can mislead routing logic into sending unrelated prompts or user data to a tool that does not actually satisfy the requested function, increasing privacy and integrity risks.
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
parser = argparse.ArgumentParser(description="Generate video using xplai API")
parser.add_argument("question", type=str, help="Video content description")
parser.add_argument("-image", "--image", type=str, help="Image URL for video generation")
parser.add_argument("-d", "--debug", action="store_true", help="Enable debug mode to print request/response details")
args = parser.parse_args()
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
parser = argparse.ArgumentParser(description="Generate video using xplai API")
parser.add_argument("question", type=str, help="Video content description")
parser.add_argument("-image", "--image", type=str, help="Image URL for video generation")
parser.add_argument("-d", "--debug", action="store_true", help="Enable debug mode to print request/response details")
args = parser.parse_args()
The skill invokes an external service and therefore has network-capable behavior, but it does not declare any explicit tool scope or allowed-tools restrictions. That weakens sandboxing and reviewability, making it easier for a skill to transmit user content off-platform without clear authorization boundaries.
The trigger guidance says to use this skill whenever the user asks to make a video, explain visually, show how, or create a tutorial, which is overly broad. Such expansive matching can cause unintended invocation in contexts where users did not consent to external processing or where a non-video explanation would be more appropriate.
The skill directs prompts to the xplai.ai service but does not warn users that their descriptions, ideas, images, or possibly sensitive educational/business content may be transmitted to a third party. In this context, the omission is more dangerous because the skill explicitly encourages proactive recommendations in common scenarios like math, code, news, and language learning, increasing the chance of silent external data sharing.
The debug helpers print full request parameters/JSON and full response bodies with no redaction, which can expose API keys, bearer tokens, user prompts, personal data, or generated content in logs when debugging is enabled. In a video-generation skill that may handle rich user inputs and external API responses, this increases the chance of sensitive data disclosure through console logs, CI logs, hosted runtime logs, or support captures.
The skill sends user-supplied question text and an optional image value to an external third-party API without any in-code warning, consent gate, or data-sensitivity check in the execution path. In an agent setting, users may provide sensitive text or internal URLs/images, and this code will transmit them off-platform, creating privacy and data-handling risk.
This code sends the provided video_id to the remote xplai API over HTTPS, but outside of optional debug mode there is no user-facing print, warning, or comment disclosing that input will be transmitted to an external service. For a code file, network calls that transmit user data should have some visible disclosure unless clearly covered elsewhere.
No suspicious patterns detected.