T08 · Insecure Dependencies
Warning
- Location
SKILL.md:28- Finding
Remote Python Dependency Is Installed Without Immutable Integrity Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
NewTest白木
Security checks for vulnerabilities and agentic risk
Overview
The skill appears purpose-aligned, but it needs review because it installs remote executable code and can use cloud video, file, credential, voice, and account operations with some under-scoped safeguards.
Review the external narrator-ai-cli source and pin it to a reviewed commit or hashed artifact before installing. Use a dedicated environment and scoped API key, do not run it as an administrator, confirm each upload, URL transfer, deletion, voice clone, account-key action, and budget estimate before execution, and avoid sending sensitive or copyrighted media unless you are comfortable with Narrator AI cloud processing.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (22)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README markets the skill with a very broad natural-language trigger ('create a movie narration video') that could cause an agent to auto-select this skill whenever a user mentions narration or video creation. In agents that route by fuzzy matching, this increases the chance of unintended activation and downstream API usage, uploads, or paid task creation without explicit confirmation.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
The 'Any markdown-reading agent' installation plus the tip that 'most agents can read the GitHub repo structure and auto-configure' promotes broad, low-friction ingestion of remote repository content by agents. In the context of agent skills, encouraging automatic repo-based loading increases supply-chain risk because host agents may import and act on unreviewed instructions from external content.
- Content
Any markdown-reading agent:
bash cp SKILL.md /path/to/agent/skills/narrator-ai-cli/SKILL.md💡 Tip: You can also just give the agent this repo URL — most agents can read the GitHub repo structure and auto-configure.
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The example prompts are generic requests like 'Create a narration video' and 'Make 5 narration videos,' which encourage broad auto-invocation by host agents. Because this skill can initiate multi-step production workflows, generic phrasing raises the risk of accidental execution, cost-incurring operations, and unintended handling of user media.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README describes API-backed video generation, file operations, voice cloning, and text-to-speech, but it does not clearly warn users that prompts, scripts, uploaded media, and possibly voice data may be transmitted to an external service. This omission undermines informed consent and may expose sensitive content or biometric data to third parties.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README encourages a very broad natural-language invocation pattern such as '帮我做一个电影解说', which overlaps with ordinary user conversation and does not define clear activation boundaries. In agent environments, this can cause the skill to trigger unexpectedly and begin multi-step media-generation actions without sufficiently explicit user intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The README describes a fully automatic pipeline from search to synthesis to download link return, but does not warn users that prompts, media selections, generated scripts, and output assets may be transmitted to external services. Lack of disclosure weakens informed consent and can expose sensitive user data or copyrighted materials to remote processing.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
小龙虾 OpenClaw：
bash mkdir -p ~/.openclaw/skills/narrator-ai-cli cp SKILL.md ~/.openclaw/skills/narrator-ai-cli/SKILL.md
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
小龙虾 OpenClaw：
bash mkdir -p ~/.openclaw/skills/narrator-ai-cli cp SKILL.md ~/.openclaw/skills/narrator-ai-cli/SKILL.md
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
小龙虾 OpenClaw：
bash mkdir -p ~/.openclaw/skills/narrator-ai-cli cp SKILL.md ~/.openclaw/skills/narrator-ai-cli/SKILL.mdWorkBuddy / QClaw（腾讯系）：
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
小龙虾 OpenClaw：
bash mkdir -p ~/.openclaw/skills/narrator-ai-cli cp SKILL.md ~/.openclaw/skills/narrator-ai-cli/SKILL.mdWorkBuddy / QClaw（腾讯系）：
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
小龙虾 OpenClaw：
bash mkdir -p ~/.openclaw/skills/narrator-ai-cli cp SKILL.md ~/.openclaw/skills/narrator-ai-cli/SKILL.mdWorkBuddy / QClaw（腾讯系）：
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
小龙虾 OpenClaw：
bash mkdir -p ~/.openclaw/skills/narrator-ai-cli cp SKILL.md ~/.openclaw/skills/narrator-ai-cli/SKILL.mdWorkBuddy / QClaw（腾讯系）：
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
小龙虾 OpenClaw：
bash mkdir -p ~/.openclaw/skills/narrator-ai-cli cp SKILL.md ~/.openclaw/skills/narrator-ai-cli/SKILL.mdWorkBuddy / QClaw（腾讯系）：
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
The note that users can 'send the repository address to AI' so it can learn installation automatically encourages an agent to inspect repository structure and self-configure with limited user review. In some agent ecosystems, this can expand the effective trust boundary and lead to unintended discovery of skill locations, configuration files, or additional instructions fetched from remote content.
- Content
其他支持 Markdown 技能文件的 Agent：
bash cp SKILL.md /path/to/agent/skills/narrator-ai-cli/SKILL.md💡 提示：你也可以直接把本仓库地址发给 AI，让它自己学习安装——大部分 Agent 都能理解 GitHub 仓库结构并自动完成配置。
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Telling users to 'directly use natural language with AI' without guardrails implies the skill may activate on loosely related requests. Because the documented workflow includes searching, generation, synthesis, and returning links, ambiguous triggering can lead to unintended external operations and resource consumption.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documented capabilities include file upload, download, listing, and deletion, but there is no accompanying warning about destructive actions, remote storage, or handling of sensitive local files. In an agent context, exposing such operations without safety guidance increases the chance of accidental data disclosure or deletion.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest describes a CLI for creating AI-narrated film/drama commentary videos, but these instructions explicitly direct the agent to invoke arbitrary external command-line tools to process JSON output. Spawning general-purpose shell and Python commands is not an obvious requirement of the skill itself and expands the agent's capabilities beyond using the narration CLI alone.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
file transfer --linkpermits the agent workflow to cause the backend or CLI to fetch arbitrary remote URLs, which creates an SSRF-like capability and broadens data ingress beyond explicit local files. In an agent setting, an attacker could supply crafted URLs to make the system retrieve internal resources, unexpected large files, or untrusted content from arbitrary hosts.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documentation repeatedly instructs use of
material listand selection of pre-built movies with associatedvideo_file_idandsrt_file_id, meaning the skill can access provider-hosted media metadata and linked source assets beyond files the user uploads. That directly conflicts with the absolute wording in the privacy/scope statement.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This manifest declares NARRATOR_APP_KEY as the primary and required environment variable, which indicates the skill depends on sensitive credentials. In this JSON file there is no accompanying disclosure about the sensitivity of that value, how it will be used, or any caution to the user when supplying it.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
整个文件以中文面向用户提供操作说明，仅在开头提供一个英文版链接，但当前文档内容本身未说明语言偏好是否可选，也未说明该技能是否仅面向中文用户。按自然语言政策要求，面向广泛用户的技能文档若隐含固定语言，应更明确地提供语言选择或适用范围。
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The manifest description says to use the skill for "creating narration videos, film commentary, short drama dubbing, or video production," and the last phrase is much broader than the skill's actual specialized CLI workflow. Because this file is user-invocable metadata, the vague scope could cause unintended invocation for ordinary video-production tasks unrelated to Narrator AI narration workflows.
- Content
Static analysis
No suspicious patterns detected.