wan-video-clone

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill is explicitly designed to produce deepfake videos (face + voice cloning) of a named individual by uploading source video/audio and derived assets to external APIs (fal.ai) — a clear facilitation of targeted impersonation and potential unauthorized data exfiltration; it also disables TLS certificate validation (NODE_TLS_REJECT_UNAUTHORIZED=0), increasing risk of credential/data interception.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The script clearly downloads and ingests arbitrary videos from user-supplied URLs (see the --video handling and downloadFile call for HTTP inputs) and then processes/uploads those untrusted third-party files through the pipeline (ffmpeg, fal.ai face/voice/WAN APIs), so external content directly influences processing and downstream tool actions.