edit-video

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). github.com/ggerganov/whisper.cpp and remotion.dev are reputable project/vendor sites, but the Google Drive direct-download template (drive.usercontent.google.com) is a user-hosted file endpoint that can serve arbitrary files (including executables) and is commonly used to distribute malware, so it is suspicious.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Skill.md instructs uploading/downloading Drive Shortform/Raw/ videos, then LLM-ingesting the resulting captions/transcripts (first 10s for slug/hook matching and full transcription for cleaning) inside Steps 1–3, which originate from outsider-authored video/audio content.