Security audit
Security checks for vulnerabilities and agentic risk
This skill gives straightforward ffmpeg instructions to reduce voices in video audio, with no hidden code or persistence, though users should avoid overwriting original videos without a backup.
Install only if you want a simple ffmpeg-based workflow for reducing speech frequencies in videos. Review the generated '_novoice' file before replacing anything, keep backups of original media, and only run the sudo package-install command if you trust your system package manager and actually need ffmpeg installed.
The trigger description is overly broad and can activate on many loosely related requests, which increases the chance the agent invokes this skill in the wrong context. Because the skill alters media content and is framed around multiple paraphrases, weak activation boundaries can cause unintended processing or bypass more appropriate, narrower tools.
The README centers Chinese natural-language trigger phrasing without an explicit user language preference or opt-in, which can bias skill routing and response behavior in multilingual environments. This is mainly a safety and UX boundary issue: the agent may infer language-specific behavior from the skill description rather than the user's current context.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# Ubuntu/Debian
sudo apt-get install -y ffmpeg
# macOS
brew install ffmpeg
The skill instructs users to replace the original file with mv "INPUT_novoice.mp4" "INPUT.mp4", which can irreversibly overwrite the source media if the user follows it without preserving a backup. In this context, the command is not inherently malicious, but the lack of explicit backup, verification, and confirmation guidance creates a real risk of accidental data loss, especially because the skill is aimed at media editing where source files may be valuable.
No suspicious patterns detected.