Skill Veo3 Video Gen

• Analyzed: May 11, 2026, 5:01 AM
• Findings: 1
• Version: 1.0.0
• Hash: 63896ab9620e338680193c1654fea33afcfcc8a27615992b2278a98ed6cafeba
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is suspicious due to multiple file system vulnerabilities in `scripts/generate_video.py`. The `--filename` argument is vulnerable to path traversal, allowing an attacker to write files to arbitrary locations. Additionally, the `--reference-image` and `--last-frame-image` arguments allow arbitrary file reads, potentially exposing sensitive data if the agent has broad file system permissions. These are critical vulnerabilities that could be exploited, but there is no clear evidence of intentional malicious behavior such as data exfiltration to an unauthorized endpoint or backdoor installation.