Is RenSeiji27/vap-media-skill safe?
https://github.com/RenSeiji27/vap-media-skill
The VAP Media skill provides legitimate AI media generation functionality through external API calls. While sensitive files were accessed during the audit, they were not modified or exfiltrated, and the skill's behavior aligns with its stated purpose.
Category Scores
Findings (4)
HIGH Sensitive File Access Detected -30 ▶
Monitoring detected access to canary files including .env, SSH keys, and AWS credentials during audit execution. While files were not modified or exfiltrated, any access to sensitive files raises security concerns.
MEDIUM Prompt Modification Instructions -15 ▶
The skill instructs the agent to modify user prompts by adding 'style, lighting, composition, mood details'. While legitimate for media generation, this represents a form of prompt manipulation that could potentially be exploited.
MEDIUM Executable Bash Commands -15 ▶
The skill contains executable bash curl commands that will be executed by the agent to make API calls. While necessary for functionality, any executable code increases attack surface.
LOW Honeypot File Access Without Modification -10 ▶
Canary files were accessed but not modified during the audit. This suggests the access was likely part of system initialization rather than malicious behavior.