T08 · Insecure Dependencies
Warning
- Location
SKILL.md:21- Finding
Unverified Remote CLI Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
AI解说大师 Narrator AI Skill
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent video-narration automation wrapper, but users should understand it installs and runs an external CLI that uses an API key and can upload media to a cloud service.
Install only if you are comfortable trusting the external narrator-ai-cli package and the Narrator AI cloud service with your API key, selected media/subtitle files, generated task data, and account operations. Prefer the pinned release path, review the upstream CLI if handling sensitive media, and ask the agent to confirm uploads, costs, bulk generation, deletes, and account/key actions before running them.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (24)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README encourages broad natural-language activation such as 'create a movie narration video,' which can cause an agent to invoke this skill without strong intent confirmation. In agents that auto-route by semantic similarity, this increases the chance of unintended execution of video-generation workflows and associated API usage.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The example prompts are open-ended and action-oriented, including bulk generation ('Make 5 narration videos'), without documenting boundaries, confirmation, or cost/privacy implications. In an agent ecosystem, these examples can train users and model routing layers toward automatic execution of remote operations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README advertises file operations, uploads/downloads, task saving, and remote API-backed media generation but does not clearly warn that local files or generated assets may be transmitted to external services. Users may authorize the skill without understanding data handling, persistence, or third-party exposure risks.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README uses a very broad natural-language activation phrase (“帮我做一个电影解说”), which can cause an agent to invoke this skill on loosely related requests without strong user intent confirmation. Because the skill can trigger external API use and automated video-generation workflows, ambiguous activation increases the chance of unintended actions and data transmission.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The workflow description says the agent will automatically search, generate scripts, synthesize videos, and return download links, but it does not clearly warn that these steps may involve external API calls, media uploads, and transmission of user-provided content. This is a data-handling transparency issue that can expose users to privacy, compliance, or cost risks if the agent acts without informed consent.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
小龙虾 OpenClaw：
bash mkdir -p ~/.openclaw/skills/narrator-ai-cli cp SKILL.md ~/.openclaw/skills/narrator-ai-cli/SKILL.md
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
小龙虾 OpenClaw：
bash mkdir -p ~/.openclaw/skills/narrator-ai-cli cp SKILL.md ~/.openclaw/skills/narrator-ai-cli/SKILL.md
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
小龙虾 OpenClaw：
bash mkdir -p ~/.openclaw/skills/narrator-ai-cli cp SKILL.md ~/.openclaw/skills/narrator-ai-cli/SKILL.mdWorkBuddy / QClaw（腾讯系）：
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
小龙虾 OpenClaw：
bash mkdir -p ~/.openclaw/skills/narrator-ai-cli cp SKILL.md ~/.openclaw/skills/narrator-ai-cli/SKILL.mdWorkBuddy / QClaw（腾讯系）：
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
小龙虾 OpenClaw：
bash mkdir -p ~/.openclaw/skills/narrator-ai-cli cp SKILL.md ~/.openclaw/skills/narrator-ai-cli/SKILL.mdWorkBuddy / QClaw（腾讯系）：
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
小龙虾 OpenClaw：
bash mkdir -p ~/.openclaw/skills/narrator-ai-cli cp SKILL.md ~/.openclaw/skills/narrator-ai-cli/SKILL.mdWorkBuddy / QClaw（腾讯系）：
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
小龙虾 OpenClaw：
bash mkdir -p ~/.openclaw/skills/narrator-ai-cli cp SKILL.md ~/.openclaw/skills/narrator-ai-cli/SKILL.mdWorkBuddy / QClaw（腾讯系）：
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
小龙虾 OpenClaw：
bash mkdir -p ~/.openclaw/skills/narrator-ai-cli cp SKILL.md ~/.openclaw/skills/narrator-ai-cli/SKILL.mdWorkBuddy / QClaw（腾讯系）：
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
While the path example itself is benign, the adjacent guidance encouraging users to give the repository URL directly to an AI so it can 'learn installation' and 'automatically complete configuration' increases risk in agent environments. That pattern can normalize autonomous ingestion and installation of remote skill content without human review, which is more dangerous than simple path disclosure.
- Content
其他支持 Markdown 技能文件的 Agent：
bash cp SKILL.md /path/to/agent/skills/narrator-ai-cli/SKILL.md💡 提示：你也可以直接把本仓库地址发给 AI，让它自己学习安装——大部分 Agent 都能理解 GitHub 仓库结构并自动完成配置。
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The example prompts for starting the skill are still generic and action-oriented, without defining when the agent should ask follow-up questions versus directly invoking the CLI. In an agent environment, this can lead to over-triggering, accidental job creation, and unintended use of external resources.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md version: "1.0.2" license: MIT description: >- AI电影解说视频自动生成技能（AI解说大师 CLI Skill）。当用户需要创建电影解说视频、短剧解说、影视二创、AI配音旁白视频、film commentary、video narration、drama dubbing、movie narration时触发。内置93部电影素材、146首BGM、63种配音音色（11种语言）、90+解说模板。通过narrator-ai-cli命令行工具实现：搜片选片→选择模板→选BGM→选配音→生成文案→合成视频的全流程自动化。CLI client for Narrator AI (AI解说大师) video narration API. Use when user needs to create AI narration videos, manage narration tasks, browse dubbing/BGM/material resources, or automate video production. user-invocable: true tags: - video-narration
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The invocation text is broad enough to trigger on many generic content-creation requests, increasing the chance the skill activates in contexts where the user did not specifically request this external service. In a user-invocable skill that can upload files and create remote tasks, over-broad matching raises the risk of unintended disclosure of user media or metadata to the third-party service.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Defaulting generated output language to Chinese without explicit user choice can cause unintended transmission or transformation of user content in a language they did not request. In a media-generation workflow, that can create incorrect outputs, privacy misunderstandings, or accidental publication in the wrong language.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md 1. **`confirmed_movie_json` is required for target_mode=1 and target_mode=2, optional for target_mode=3.** When a pre-built material is found, construct it from material fields directly (no `search-movie` needed). For mode=1 or mode=2 with user-uploaded SRT (no material), always run `search-movie` — never fabricate this value. 2. **Source file_ids from `file list` or `material list`.** Never guess file_ids. 3. **Tasks are async.** Create returns `task_id` → poll `task query <task_id> --json` until status `2` (success) or `3` (failed). 4. **`search-movie` may take 60+ seconds** (Gradio backend, cached 24h). Set adequate timeout. 5. **video-composing uses the clip-data step's `order_info.order_num`** (clip-data in Standard Path, fast-clip-data in Fast Path). NOT the writing step's order_num — this is the most common mistake. 6. **Prefer pre-built narration templates** over running popular-learning. Use `task narration-styles --json` to list, browse https://ceex7z9m67.feishu.cn/wiki/WLPnwBysairenFkZDbicZOfKnbc for preview.
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The privacy section states that all API requests go only to the Narrator AI endpoint, but the documented upload design explicitly performs direct uploads to a presigned OSS URL. This can mislead users about where their media is transmitted and creates a transparency/privacy issue, especially because uploaded media may contain sensitive or copyrighted content.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The description contains very broad trigger phrases such as general content-creation, dubbing, and video-production requests, which can cause the skill to activate in situations beyond a user's specific intent to use this external CLI. Over-broad activation increases the chance of unintended tool use, unnecessary exposure of user data to the tool/API, and surprising actions in mixed workflows.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
Policy-violation checks apply to all file types. The file forces a single language presentation and does not indicate user opt-in or a justified locale restriction within this document, which can conflict with language-choice policies.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
L159 instructs the agent to use
greporpython3 -con CLI output as part of the workflow, which means the skill documentation explicitly relies on invoking additional local executables beyond the named CLI. Later, L799 claims the skill 'only orchestrates CLI commands,' creating a documentation-level contradiction about what code/tooling the skill expects the agent to run.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 68% confidence
- Finding
The manifest advertises '63种配音音色（11种语言）' and a bilingual description, but it does not explicitly state that language selection is based on user preference or opt-in. In natural-language policy review, fixed or implied language behavior without a stated user choice can be a locale-policy concern.
- Content
Static analysis
No suspicious patterns detected.