T09 · Insecure Skill Coding Practices
Error
- Location
scripts/analyze.rb:76- Finding
Arbitrary API Endpoint Override Exposes Media and Bearer Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
douyin-video-distiller
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent video-distillation purpose, but it can upload whole media files and the NVIDIA API bearer token to a user-configurable endpoint, so it should be reviewed before installation.
Install only if you are comfortable with selected videos or images being sent to NVIDIA or to any endpoint configured by the environment. Before using it, verify NVIDIA_ENDPOINT is unset or restricted to the intended HTTPS NVIDIA host, avoid private or regulated media unless you have explicit approval to upload it, and treat the non-upload promise for sensitive content as unenforced by the bundled script.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/analyze.rb:78- Finding
Declared Sensitive-Content Non-Upload Policy Is Not Enforced
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
描述强调的是面向抖音短视频的知识蒸馏场景，但代码实际实现的是一个通用文件分析脚本。它接受本地图片或视频路径和任意指令，将内容发送给 NVIDIA 模型处理，因此可用于 OCR、图片理解、一般视频总结等多种用途。与声明相比，最明显的不一致有两点：一是代码不支持抖音链接抓取/解析，只能处理本地文件；二是它没有实现专门的“蒸馏成知识卡片/时间线/证据/第二大脑资料”的固定工作流，只是把用户指令原样转发给模型。虽然用户可以手动要求模型总结视频，这与声明部分重叠，但整体能力范围和接口形式都比声明更通用且存在关键缺口，因此应判定为不匹配。
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill declares no explicit tool scope or allowed-tools despite instructing the agent to perform network-enabled actions such as downloading Douyin content and calling external APIs. This is dangerous because it expands the agent’s effective capabilities without clear policy boundaries, increasing the chance of unauthorized network access, unintended data egress, or misuse of ambient credentials.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger description contains broad natural-language examples like turning a video into searchable knowledge, which can overlap with ordinary conversation and cause accidental invocation. This is dangerous because misfires may cause the agent to initiate downloads, analyze local media, or process sensitive content when the user did not intend to run this higher-privilege workflow.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script base64-encodes the full local image/video and sends it, along with the user’s instruction, to a third-party NVIDIA API endpoint. For a video-distillation skill, inputs are likely to contain personal, confidential, or regulated data, and the script provides no explicit consent prompt, privacy warning, or data-minimization controls before transfer. This is dangerous because users may assume local-only processing and unintentionally disclose sensitive content to an external service.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This JSON file contains user-facing prompt and output expectations exclusively in Chinese, which effectively constrains the skill to a specific language without indicating user choice or explicit locale scoping. Under the policy, forced language behavior without opt-in can be a natural-language policy violation.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The code reads an API key from the environment and uses it for outbound authentication. Although this is expected for an API client, there is no explicit comment or user-facing notice clarifying that the script depends on and will use a credential from the environment.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This markdown file contains user-facing natural language that implicitly forces a specific language, but it does not mention any user opt-in, bilingual support, or justified region-specific constraint. Under the language/locale policy rule, a fixed language can be a policy issue when no choice or rationale is provided.
- Content