video-use

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs the agent to ask the user to paste ELEVENLABS_API_KEY and write it into a .env file, which requires the LLM to receive and output the secret value verbatim (high exfiltration risk).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s runtime workflow ingests outsider-authored free text when the user provides footage that is transcribed (e.g., via transcribe.py/transcribe_batch.py and then pack_transcripts.py), producing LLM-readable transcripts (transcripts/*.json → takes_packed.md) that the editor/cut logic reads.