Security audit

Carpet Wash Video

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent WeryAI carpet-cleaning video generation skill that clearly discloses its API key and network use.

Install only if you trust the publisher and are comfortable sending prompts and supplied image URLs to WeryAI. Use a dedicated API key if possible, keep WERYAI_BASE_URL and WERYAI_MODELS_BASE_URL unset unless you intentionally trust those hosts, and avoid submitting sensitive images or private prompts.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/video_gen.js:23