video-use

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly tells the agent to ask the user to paste an ELEVENLABS_API_KEY and write it into a .env file, which requires the LLM to accept and embed a secret verbatim in its output/files.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In helpers/pack_transcripts.py and helpers/render.py, the skill ingests user-supplied Scribe transcript text produced from the provided source videos (transcripts/*.json → takes_packed.md / master.srt) and the agent then reasons from that runtime text via takes_packed.md during cut selection and subtitle generation.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The install instructions show the agent cloning and installing remote code from https://github.com/browser-use/video-use (e.g., "git clone https://github.com/browser-use/video-use ..."), which fetches repository code at runtime that the agent may install/execute and thus can change agent behavior.