Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed WeryAI video-generation helper that uses a local Node script and an API key to submit confirmed art-process video jobs.
Install only if you intend to use WeryAI and are comfortable providing WERYAI_API_KEY. Review any WERYAI_BASE_URL or WERYAI_MODELS_BASE_URL overrides before running, and rely on the built-in confirmation step because successful wait runs consume paid credits.
Referenced artifact was not completely inspected
**Dependencies**: `scripts/video_gen.js` in this directory + `WERYAI_API_KEY` in the environment + Node.js 18+. No dependency on other Cursor skills.
Referenced artifact was not completely inspected
**Dependencies**: `scripts/video_gen.js` in this directory + `WERYAI_API_KEY` in the environment + Node.js 18+. No dependency on other Cursor skills.
Referenced artifact was not completely inspected
**Dependencies**: `scripts/video_gen.js` in this directory + `WERYAI_API_KEY` in the environment + Node.js 18+. No dependency on other Cursor skills.
Referenced artifact was not completely inspected
**Dependencies**: `scripts/video_gen.js` in this directory + `WERYAI_API_KEY` in the environment + Node.js 18+. No dependency on other Cursor skills.
Referenced artifact was not completely inspected
**Dependencies**: `scripts/video_gen.js` in this directory + `WERYAI_API_KEY` in the environment + Node.js 18+. No dependency on other Cursor skills.
Referenced artifact was not completely inspected
- Does not hard-code absolute paths in the skill doc; `{baseDir}` means the skill package root (same level as `SKILL.md`).
The skill requires access to an environment secret (WERYAI_API_KEY) and outbound network connectivity, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates a least-privilege gap: an installer or runtime may not have a clear, enforceable boundary on what the skill is allowed to access, increasing the chance of accidental overexposure of secrets or unintended network use.
The implicit trigger example is broad enough that the skill may activate on general art or illustration requests without an explicit request for process-video generation. In an agent setting, overbroad routing can cause unintended tool use, unnecessary external API calls, and user surprise, especially because this skill is specialized for vertical creative-process videos rather than generic image editing or design help.
The top-level CLI description, command documentation, examples context, and environment-variable guidance are written in Chinese, establishing a fixed language for user-facing interaction. The file does not indicate that language selection is optional or that this is a region-specific tool, so it appears to impose a locale without user opt-in.
The trigger test includes a Chinese prompt as a positive activation example, but the file does not state whether multilingual triggering is intentional, optional, or user-selected. When language behavior is implicit rather than documented, it can create unclear locale expectations and policy ambiguity.
Detected: suspicious.env_credential_access