motion-video-production

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill instructs downloading and building packages via npm ci from the npm registry inside the user's workspace, which constitutes an operational dependency with common unofficial provenance.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill's documented operations involve planning and building motion graphics and promo videos using engines like Remotion or HyperFrames, and generating audio via ElevenLabs or Fish Audio through the composio CLI (SKILL.md:3, 140). The instructions explicitly state that the agent does not perform logins or payments automatically and requires user permission before proceeding with actions that incur costs or require paid subscriptions (SKILL.md:13, 159). There are no direct financial transfer, purchase, trade, or settlement operations initiated or executed by the skill itself, making this an indirect financial scope (incurring service costs / API usage). Therefore, the financial-security exposure level is medium due to indirect financial operations.