Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed paid WeryAI video-generation skill with expected network and API-key use, but users should review prompts and images before sending them to WeryAI.
Install only if you are comfortable using a paid WeryAI API key and sending prompts plus any referenced public image URLs to WeryAI. Before confirming generation, check that the model is SEEDANCE_2_0, the prompt contains no private or confidential content, and the requested run is worth the likely credit cost.
The documented purpose presents a narrowly styled transformation skill, but the behavior described is broader: general video generation, polling, model listing, and secret-backed API access. That mismatch can mislead users and reviewers about the real capability surface, increasing the chance of unintended paid actions, data disclosure to third parties, or misuse outside the advertised scope.
Referenced artifact was not completely inspected
- `WERYAI_API_KEY` **must be set** before running `video_gen.js`.
Referenced artifact was not completely inspected
- `WERYAI_API_KEY` **must be set** before running `video_gen.js`.
Referenced artifact was not completely inspected
- `WERYAI_API_KEY` **must be set** before running `video_gen.js`.
Referenced artifact was not completely inspected
- `WERYAI_API_KEY` **must be set** before running `video_gen.js`.
Referenced artifact was not completely inspected
- `WERYAI_API_KEY` **must be set** before running `video_gen.js`.
The skill declares no explicit tool scope despite requiring environment-secret access and outbound network use. This weakens least-privilege controls and informed consent, making it easier for an agent to invoke capabilities the user or platform did not clearly authorize.
The file claims the skill uses only SEEDANCE_2_0, but explicitly admits the script does not enforce that restriction. An agent or downstream wrapper could submit a different model than intended, bypassing policy, cost, content-safety, or capability constraints tied to this supposedly locked-down skill.
The instructions require the agent to turn every brief into a full English production prompt, with only a narrow exception for already-finished long prompts. This forces a specific language choice regardless of the user's preferred language and does not offer any opt-in or alternative locale handling.
The scenario guidance explicitly says to expand the user's request into English, again imposing a fixed language choice in operational instructions. Because no user choice or documented justification is provided here, this conflicts with the language/locale policy requirement.
The implicit trigger prompt is broad enough to match generic requests for pastel, fairytale, or vertical style edits, which can cause the skill to activate when the user did not explicitly intend to use it. This creates misrouting risk, increases the chance of unintended tool execution, and may interfere with safer or more appropriate skills in adjacent creative-editing domains.
This documentation explicitly instructs users to send prompts and public image URLs to third-party WeryAI API hosts, but it provides no privacy notice, consent guidance, or warning against including sensitive data. In a content-generation skill, prompts and referenced media can easily contain personal, proprietary, or confidential information, so the omission creates a real data-sharing risk even if the API usage itself is expected.
This JavaScript file contains user-facing natural-language documentation entirely in Chinese, including command descriptions, examples, and environment-variable guidance. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the restriction is explicitly justified, which is not present here.
L028 asserts that API hosts are fixed in video_gen.js and that only WERYAI_API_KEY is read from the environment, presenting this as an implementation fact. Since this skill file also acknowledges elsewhere that important constraints are not enforced in code, this host-fixity claim appears to be documentation-level intent that may not reflect actual enforced behavior.
No suspicious patterns detected.