审计历史

The skill is a documentation/instruction file (no executable code) that guides an AI assistant to run shell commands (yt-dlp, ffmpeg, curl) and make API calls to verging.ai. All 82 static findings are false positives in context: backtick patterns are markdown code examples, URLs are legitimate API endpoints, API key references are standard authentication documentation, and temp directory access is standard media processing. The combination of network + credentials + external commands is expected for this use case. No malicious intent detected. Risk level is medium due to the breadth of system access required.

This is a legitimate face swap API client skill. The static findings reflect expected behavior: network calls to the verging.ai API service, environment variable access for API key authentication, and external command execution for video processing tools (yt-dlp, ffmpeg, curl). These are all necessary for the skill's core functionality. No malicious intent detected.

Static analysis flagged 77 patterns but all are false positives. Network URLs point to documented verging.ai API endpoints. Environment variable access is for user-provided API key authentication. Shell commands in SKILL.md are markdown documentation examples, not executable code. Temp directory usage is documented with cleanup. Skill is a legitimate CLI wrapper for a paid AI service.