ai-video-gen Audit report.

Warnings

• Dependency or permission surface needs review
• Permission surface may require sandboxing
• Internal contradiction: the skill states 'Do not describe any gateway as the default or top choice' but then explicitly names Seedance 2.0 as the 'Preferred premium default' and VEO 3.1 as the default provider in the request fields table.
• The skill instructs 'Always use video_selector' but does not define or document this tool, and the provided examples call provider tools directly, creating confusion about the intended workflow.
• References to Layer 3 documents (gemini-omni, seedance-2-0, pika-h3-flex) are made but these documents are not included in the skill directory, leaving gaps in the prompting guidance for those providers.
• The provider table lists Pika API as a gateway, but the description and authentication section omit Pika API, and the skill's metadata does not include PIKA_API_KEY in the required environment variables.
• Permission surface needs review: secrets or environment access, shell or command execution
• Dependency/runtime risk: command execution surface, credential or environment access
• Permission surface: secrets or environment access, shell or command execution

Method

This report combines public metadata, AI review output, repository freshness, install readiness, OpenAgentSkill events, quality scoring, trust checks, and the agent safety gate. It is not a full source-code security review.