Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward AI video generator that sends user-provided prompts and optional images to chosen third-party video APIs, with no evidence of hidden persistence, credential theft, or destructive behavior.
Install only if you are comfortable sending prompts and any selected images to Luma, Runway, or Kling using your own API keys. Avoid confidential, regulated, or personal images unless those providers are approved for that data, and verify the Kling image-input behavior before relying on local file paths.
The skill declares environment-variable requirements and clearly depends on networked third-party APIs, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens reviewability and least-privilege controls, making it easier for an agent runtime to grant broader access than users expect when handling API keys and outbound requests.
The documentation instructs users to send prompts and optional input images to external video-generation providers but does not warn that this data leaves the local environment and may be stored, logged, or used under third-party policies. Users may unknowingly upload sensitive text or images, creating privacy, confidentiality, and compliance risks.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
print(f" Input Image: {input_image}")
# Luma API 端点
url = "https://api.lumalabs.ai/dream-machine/v1/generations"
headers = {
"Authorization": f"Bearer {api_key}",
When --input-image is provided, the script reads the local image file and sends its contents to the Luma API as base64 data. Although the code logs the file path and generally describes generation, it does not clearly disclose that local image content will be uploaded to a third-party service, which is a privacy-relevant operation for a code file.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
print(f" Prompt: {prompt}")
# Runway Gen-2 API
url = "https://api.runwayml.com/v1/generations/video"
headers = {
"Authorization": f"Bearer {api_key}",
If an input image is supplied, the script opens the local file, encodes it, and includes it in the request body sent to Runway. The surrounding output does not explicitly warn the user that local file contents are being transmitted off-system to an external provider.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
print(f" Prompt: {prompt}")
# Kling API (示例端点，实际需根据官方文档调整)
url = "https://api.klingai.com/v1/videos"
headers = {
"Authorization": f"Bearer {api_key}",
The CLI help text says --input-image is an input image path for image-to-video generation, implying a local file path. But in the Kling implementation, the same value is sent as image_url without reading or uploading the file, so a local path will not behave as documented and the implementation expects a URL-shaped value instead.
The description and operational guidance are presented in Chinese, which effectively forces a specific language for users reading the skill documentation. The file does not indicate that the skill is intentionally region-specific or provide an alternative language or opt-in choice.
The file's human-facing description and many user-visible status messages are written in Chinese, and the script does not offer a locale or language selection. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
No suspicious patterns detected.