Video Generator Auto Post

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:36 AM UTC
• Version: 1.1.0

Overview

This skill is not malicious, but it needs Review because it asks for social-account posting credentials and automated public posting without enough safeguards or accurate implementation disclosure.

Review this carefully before installing. Do not put real social-media API keys in .env or run posting commands until the publisher adds clear confirmation, dry-run behavior, least-privilege setup instructions, pinned dependencies, and accurate documentation of what is actually implemented.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:143

Finding

Unpinned Third-Party Dependencies Create Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 143
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

markdown

1. Install dependencies: `pip install tweepy google-auth`

The executable script also imports an undeclared dependency at scripts/auto-post.py, line 11:

python

from dotenv import load_dotenv

Technical Analysis

The installation instructions direct users to install tweepy and google-auth without exact versions, cryptographic hashes, or a reviewed lockfile. Consequently, package resolution depends on mutable package-index state at installation time. The installed versions and their transitive dependency graphs may differ between installations.

If the configured package index, a package release, maintainer account, or transitive dependency is compromised, installation may introduce attacker-controlled code. Python packages can execute code during build or installation, while imported packages execute code with the privileges of the Python process at runtime.

In addition, scripts/auto-post.py imports python-dotenv, but the documented installation command does not install or pin that package. This omission creates unreliable deployment behavior and may encourage users to install an arbitrary package ad hoc.

No evidence demonstrates that the currently named packages are malicious. The confirmed issue is the absence of dependency integrity and reproducibility controls.

Attack Path

1. A user follows the setup instructions and executes pip install tweepy google-auth.
2. pip resolves the latest available package versions and transitive dependencies from the user's configured package index.
3. An attacker compromises a relevant package release, maintainer account, dependency, or package-index route.
4. The compromised package executes malicious build or installation logic, or is imported during subsequent ...[truncated 768 chars]

Remediation

View remediation

Remediation Suggestions

1. Create a reviewed dependency manifest containing every direct dependency, including python-dotenv.
2. Pin all direct and transitive dependencies to exact versions using a lockfile generated by a tool such as pip-tools, Poetry, or uv.
3. Record cryptographic hashes and enforce them during installation, for example with:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Install dependencies in a dedicated virtual environment under a non-privileged account.
5. Review dependency changes before updating the lockfile and use automated vulnerability and provenance scanning.
6. Configure trusted package indexes explicitly and avoid unreviewed mirrors or extra indexes.
7. Remove unused dependencies from the instructions until the corresponding platform integrations are implemented.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a broader skill centered on AI video generation plus automated social publishing. This code chunk does not generate videos at all; its primary behavior is a CLI wrapper for posting an already-existing video file. Even the posting behavior is not fully implemented, since each platform method only prints status text and returns success with TODO comments for real API uploads. The description therefore materially overstates the implemented capabilities and omits the code's inclusion of YouTube Shorts support.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill encourages automatic posting to social platforms using API keys but provides no warning that content, metadata, and credentials may be sent to third-party services and may trigger account-affecting actions. In an automation context, this can lead to unintended public posting, reputational harm, account rate-limits, or misuse of connected social accounts if users do not understand the consequences.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The trigger phrase "Generate a video of..." is broad enough to match ordinary user requests, increasing the chance the skill is invoked unexpectedly. Because this skill is tied to automation and auto-posting, accidental activation could cause unreviewed content generation workflows or downstream account actions in a context where the user did not intend to use this skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Each platform-specific posting method only prints status text and returns True, while the actual API integrations are explicitly marked TODO. This means the code does not implement the auto-publishing behavior the skill description claims for supported social media platforms.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description lists Twitter, LinkedIn, Instagram, and TikTok as supported auto-post targets, but the code also exposes a youtube platform handler for YouTube Shorts. This is a behavior/scope mismatch between the declared supported platforms and the implemented interface.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The banner string hard-codes Chinese text ('小龙虾') in the normal user-facing output without offering any language or locale choice. This can violate language/locale policy when a skill imposes a specific language presentation without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.