Security audit

Video Producer

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent video-generation purpose, but it ships embedded API keys and unsafe execution paths that need human review before installation.

Do not install this version without review and remediation. Require the publisher to remove and rotate embedded API keys, disclose third-party MiniMax data sharing, replace shell-string execution with argument-array execution, validate filenames and storyboard schema, avoid raw generated-code concatenation, and sandbox rendering/output directories.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/produce.js:16
Finding: Hardcoded MiniMax API Credentials
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/produce.js:95
Finding: Shell Command Injection Through Storyboard Narration
Content: View full analysis
{ const cmd = 'MINIMAX_API_KEY=' + CONFIG.ttsApiKey + ' python3 "' + CONFIG.ttsScript + '" "' + text.replace(/"/g, '\\"') + '" --output "' + outputFile + '"'; try { const result = execSync(cmd, { encoding: 'utf-8', timeout: 60000 }); const match = result.match(/时长: ([\d.]+)秒/); const duration = match ? parseFloat(match[1]) : 3.0; resolve({ duration: duration, file: outputFile }); } catch (e) { resolve({ duration: 3.0, file: outputFile }); } }); } ``` The untrusted value reaches this function through: ```javascript const result = await generateTTS(scene.script, outputFile); ``` ### Technical Analysis `generateTTS()` builds a command as a single string and executes it with `execSync()`. Node.js therefore invokes a shell to interpret the command. The code only escapes double-quote characters in `text`. This is insufficient for shell safety. In common POSIX shells, command substitution using `$(...)` or backticks is still evaluated inside double quotes. Other shell metacharacters and shell-specific expansions may also create unsafe behavior. `scene.script` is derived from storyboard content, which ultimately originates from user-supplied points and an external director component. The API key is also concatenated into the command without shell-safe handling, providing a second injection source if the environment is attacker-controlled. The timeout limits execution duration but does not prevent command execution or undo commands that have already completed. ### Attack Path 1. An attacker supplies a video point or storyboard narration containing shell syntax, such as command substitution. 2. The external storyboard planner places that text into `s ...[truncated 1408 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/produce.js:337
Finding: Arbitrary JavaScript and JSX Injection in Generated Remotion Source
Content: View full analysis
e.type === 'emoji'); const emojiValue = emojiEl ? emojiEl.value : '📌'; const textEl = s.visual.elements.find(e => e.type === '文字'); const textValue = textEl ? textEl.value : s.title; const descEl = s.visual.elements.find(e => e.type === '描述'); const descValue = descEl ? descEl.value : ''; // 构建JSX let jsx = ''; jsx += ' <>\n'; if (hasBg) { const imgName = imports.find(i => i.sceneIndex === si && i.elementType === '背景')?.name || 'bg' + si; jsx += ' \n'; } if (featuredMaterial) { const imgName = imports.find(i => i.sceneIndex === si && i.elementType === '素材')?.name || 'mat' + si; jsx += ' \n'; } jsx += ' \n'; jsx += '
' + emojiValue + '
\n'; jsx += '
" + textValue + '
\n'; if (descValue) { jsx += "
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/produce.js:214
Finding: Storyboard-Controlled Path Traversal in Generated Material Filenames
Content: View full analysis
{ const file = fs.createWriteStream(outputPath); https.get(url, (res) => { if (res.statusCode === 301 || res.statusCode === 302) { file.close(); downloadImage(res.headers.location, outputPath).then(resolve).catch(reject); return; } res.pipe(file); file.on('finish', () => { file.close(); resolve(outputPath); }); }).on('error', (err) => { fs.unlink(outputPath, () => {}); reject(err); }); }); } ``` ### Technical Analysis `element.filename` is obtained from storyboard data and passed directly to `path.join(CONFIG.materialsDir, element.filename)`. The code does not require the value to be a basename, reject `..` segments, restrict absolute paths, or verify the final resolved path remains beneath the materials directory. A value containing traversal components can cause the normalized destination to escape `CONFIG.materialsDir`. If image generation succeeds, `downloadImage()` opens that destination with `fs.createWriteStream()`, truncating an existing file or creating a new file where the process has ...[truncated 1658 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (32)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the implementation rewrites local source files like produce.js instead of acting as a straightforward media generator, the skill behaves as a code-modification tool under a misleading label. Hidden source rewriting can introduce persistence, break neighboring projects, or smuggle malicious changes into a codebase without informed user consent.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the implementation rewrites local source files like produce.js instead of acting as a straightforward media generator, the skill behaves as a code-modification tool under a misleading label. Hidden source rewriting can introduce persistence, break neighboring projects, or smuggle malicious changes into a codebase without informed user consent.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the implementation rewrites local source files like produce.js instead of acting as a straightforward media generator, the skill behaves as a code-modification tool under a misleading label. Hidden source rewriting can introduce persistence, break neighboring projects, or smuggle malicious changes into a codebase without informed user consent.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: If the implementation rewrites local source files like produce.js instead of acting as a straightforward media generator, the skill behaves as a code-modification tool under a misleading label. Hidden source rewriting can introduce persistence, break neighboring projects, or smuggle malicious changes into a codebase without informed user consent.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the implementation rewrites local source files like produce.js instead of acting as a straightforward media generator, the skill behaves as a code-modification tool under a misleading label. Hidden source rewriting can introduce persistence, break neighboring projects, or smuggle malicious changes into a codebase without informed user consent.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script includes a real-looking API key as a fallback when the environment variable is absent, which means anyone with access to the code can reuse the credential and make unauthorized calls. In a video-production skill, embedding a hidden credential is unnecessary and increases risk of secret leakage, billing abuse, and downstream compromise if the same key is reused elsewhere.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Using a hardcoded API key fallback bypasses safe credential handling and can silently enable outbound paid API usage without the operator knowingly provisioning a secret. This exposes the credential to source disclosure, accidental redistribution, and abuse by anyone who can read the file or recover the repository history.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file embeds hardcoded API keys for external AI services and uses them by default if environment variables are absent. Anyone with access to the skill source can extract and abuse those credentials for unauthorized API usage, billing fraud, or access to service-linked data, and the skill's video-production context does not justify shipping secrets in code.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Hardcoded API credentials are not only stored in code but are automatically used and transmitted to third-party services without any explicit warning to the user. This compounds the secret-exposure issue by enabling silent external service usage under embedded credentials, increasing the chance of unnoticed abuse and unexpected data processing or charges.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: browserslist==4.28.1 — 2 advisory(ies): CVE-2026-73088 (Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.); CVE-2026-73089 (Browserslist: Unbounded memory growth (no cache eviction) via distinct query res)

High

Category: Supply Chain
Confidence: 94% confidence
Finding: browserslist 4.28.1 is reported with a crash/prototype-write issue and unbounded memory growth when processing untrusted stats/query-related input. Even though this dependency is commonly used for build tooling, prototype pollution-style behavior and resource exhaustion can become significant if any user-controllable input reaches it in automated pipelines or services.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: extract-zip==2.0.1 — 2 advisory(ies): CVE-2026-19693 (extract-zip allows arbitrary file writes through symlink archive entries); CVE-2026-56876 (extract-zip unvalidated symlink path traversal)

High

Category: Supply Chain
Confidence: 97% confidence
Finding: extract-zip 2.0.1 is associated with arbitrary file write and symlink path traversal issues during archive extraction. This is particularly relevant in a video-production skill because media workflows often ingest external assets; if archives from users or upstream tools are unpacked, an attacker could overwrite files outside the intended directory.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High

Category: Supply Chain
Confidence: 88% confidence
Finding: fast-uri 3.1.0 is flagged for multiple URI parsing issues including host confusion and SSRF-relevant normalization problems. In isolation this is just a dependency risk, but in an agent skill that may fetch remote media, parse URLs, or process user-provided endpoints, URI confusion bugs can enable access-control bypasses or unintended outbound requests.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: nanoid==3.3.11 — 3 advisory(ies): CVE-2026-67214 (nanoid: non-secure generators can loop indefinitely with negative size); CVE-2026-67213 (nanoid: custom generators can loop indefinitely when size is zero); CVE-2026-73086 (nanoid: Integer Overflow or Wraparound)

High

Category: Supply Chain
Confidence: 80% confidence
Finding: nanoid 3.3.11 is reported with several denial-of-service and overflow conditions around invalid size handling and custom/non-secure generators. This is a real dependency weakness, though its exploitability depends on whether attacker-controlled parameters influence ID generation in the skill or its toolchain.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: postcss==8.5.8 — 4 advisory(ies): CVE-2026-45623 (PostCSS: Arbitrary file read and information disclosure via attacker-controlled ); CVE-2026-69153 (PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappi); CVE-2026-41305 (PostCSS has XSS via Unescaped </style> in its CSS Stringify Output) +1 more

High

Category: Supply Chain
Confidence: 93% confidence
Finding: postcss 8.5.8 is flagged for multiple serious issues including arbitrary file read/information disclosure and XSS-related output handling. Because this skill includes web/rendering and bundling dependencies, PostCSS may process attacker-influenced style or source-mapping data in build or studio flows, making the risk more relevant than a purely dormant dependency.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.17.1 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

Category: Supply Chain
Confidence: 91% confidence
Finding: ws 8.17.1 is associated with memory disclosure and memory-exhaustion denial-of-service issues. This is especially concerning if the Remotion studio/server components expose WebSocket interfaces during rendering or preview sessions, because network-reachable parsing flaws can be triggered remotely.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill describes capabilities that inherently require privileged operations such as environment/credential access, file writes, and likely external service usage, but it declares no explicit tool scope or permissions. This creates an authorization/transparency gap where the runtime may expose more capability than users or reviewers expect, increasing the chance of unintended secret access or unsafe execution.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The description and title present the skill as a Chinese-language video-generation skill, and no opt-in or alternative language behavior is documented anywhere in the file. SQP-3 requires flagging language or locale policy violations when a specific language is imposed without user choice or clear justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill describes creating multiple files including code, media, and final outputs without warning about overwrite behavior, output paths, or disk impact. In an automation context, silent file creation/modification can destroy user data, pollute repositories, or be abused to place executable artifacts where they are later trusted.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The code serializes the user-provided prompt and sends it in an HTTPS POST request to api.minimaxi.com. Although the script logs progress, it does not clearly warn users that scene prompt content will be transmitted to a third-party service, which is relevant to privacy and data handling.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file identifies itself as a Chinese short-video generation script and references a Chinese-specific TTS path, while all user-facing logs and outputs are fixed in Chinese. There is no indication that the user can opt into another language or that the locale restriction is formally documented as a necessary regional constraint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script sends prompts and scene text derived from user input to external image-generation and TTS services, but provides no meaningful disclosure or consent mechanism before transmission. In this skill context, user content may include proprietary scripts, personal data, or sensitive business material, so silent exfiltration to third-party APIs creates a real privacy and compliance risk.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The script executes npx remotion render without pinning an exact package version or using a vendored/local dependency. If the package is missing locally, npx may resolve and run whatever version is available from the registry at execution time, creating a supply-chain execution risk in a script that already performs filesystem writes and media rendering.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script unconditionally rewrites produce.js in place using fs.writeFileSync after performing string-based code replacement, with no confirmation, backup, integrity check, or atomic write pattern. In an agent skill context, this can silently alter executable project logic, cause accidental code loss, or persist unsafe modifications if the script is triggered on an unexpected or tampered input file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This JSON file contains all user-facing content in Chinese, including the topic, point text, and ending strings. Under the policy, forcing a specific language without user opt-in or a documented region-specific justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This JavaScript file contains multiple user-visible strings in Chinese, such as the scene titles and description, while providing no indication that the skill is region-specific or that users can opt into this locale. Under the policy, forcing a specific language without user choice is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/produce.js:99