Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed WeryAI video-generation helper that uses a local Node script, a WeryAI API key, and fixed WeryAI network endpoints for its stated purpose.
Install this only if you intend to use WeryAI and are comfortable providing WERYAI_API_KEY and sending prompts plus any public image URLs to WeryAI. Before confirming a run, check the model, duration, aspect ratio, and especially generate_audio because one example conflicts with the documented audio-off default.
Referenced artifact was not completely inspected
**Dependencies**: `scripts/video_gen.js` in this directory + `WERYAI_API_KEY` + Node.js 18+. No dependency on other Cursor skills.
Referenced artifact was not completely inspected
**Dependencies**: `scripts/video_gen.js` in this directory + `WERYAI_API_KEY` + Node.js 18+. No dependency on other Cursor skills.
Referenced artifact was not completely inspected
**Dependencies**: `scripts/video_gen.js` in this directory + `WERYAI_API_KEY` + Node.js 18+. No dependency on other Cursor skills.
Referenced artifact was not completely inspected
**Dependencies**: `scripts/video_gen.js` in this directory + `WERYAI_API_KEY` + Node.js 18+. No dependency on other Cursor skills.
Referenced artifact was not completely inspected
**Dependencies**: `scripts/video_gen.js` in this directory + `WERYAI_API_KEY` + Node.js 18+. No dependency on other Cursor skills.
Referenced artifact was not completely inspected
- Does not hard-code absolute paths in the skill doc; `{baseDir}` means the skill package root (same level as `SKILL.md`).
The skill explicitly requires environment secrets and network access, but it does not declare a restrictive tool scope such as permissions or allowed-tools. That increases the chance an agent runtime grants broader capabilities than necessary, making secret exposure or unintended outbound requests harder to constrain or audit.
The invocation description is broad enough to trigger on common creative-video requests, increasing the likelihood this networked, paid, secret-dependent skill is invoked when a narrower or safer path would suffice. Overbroad auto-activation can cause unintended API calls, unnecessary credit consumption, and secret use in contexts the user did not clearly intend.
The implicit trigger phrase is broad, natural-language content that can match ordinary user requests about cleaning pet hair or short vertical videos without clearly requiring intentional skill invocation. This can cause the skill to activate unexpectedly, leading to over-triggering, incorrect tool use, or bypass of user intent boundaries in unrelated conversations.
The skill documentation repeatedly states that generate_audio defaults to false, including the confirmation table and parameter configuration. However, the example submission command uses "generate_audio":true, which directly conflicts with the documented intent and could cause the agent to submit parameters inconsistent with what it told the user.
No suspicious patterns detected.