Is RenSeiji27/vap-media-skill safe?
Yes. RenSeiji27/vap-media-skill is safe to install. Oathe's behavioral security audit gave the vap-media-skill skill by RenSeiji27 a trust score of 83/100 with 4 findings (1 high).
https://github.com/RenSeiji27/vap-media-skill
Is RenSeiji27/vap-media-skill safe to install?
The VAP Media skill provides legitimate AI media generation functionality through external API calls. While sensitive files were accessed during the audit, they were not modified or exfiltrated, and the skill's behavior aligns with its stated purpose.
What security issues were found in RenSeiji27/vap-media-skill?
Category Scores
Findings (4)
HIGH Sensitive File Access Detected -30 ▶
Monitoring detected access to canary files including .env, SSH keys, and AWS credentials during audit execution. While files were not modified or exfiltrated, any access to sensitive files raises security concerns.
MEDIUM Prompt Modification Instructions -15 ▶
The skill instructs the agent to modify user prompts by adding 'style, lighting, composition, mood details'. While legitimate for media generation, this represents a form of prompt manipulation that could potentially be exploited.
MEDIUM Executable Bash Commands -15 ▶
The skill contains executable bash curl commands that will be executed by the agent to make API calls. While necessary for functionality, any executable code increases attack surface.
LOW Honeypot File Access Without Modification -10 ▶
Canary files were accessed but not modified during the audit. This suggests the access was likely part of system initialization rather than malicious behavior.
Should I install RenSeiji27/vap-media-skill?
Oathe's verdict for RenSeiji27/vap-media-skill is SAFE with a trust score of 83/100. Recommendation: Install with caution.