Security audit

短视频脚本创作

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a local video-script template skill, but one bundled script can read or overwrite Markdown files outside its storage folder and logs user inputs locally without clear disclosure.

Review before installing. It appears local and does not fetch remote code or use credentials, but avoid using the save/show features with untrusted names and be aware it can keep local history of script topics. The publisher should fix path validation, disclose or disable logging, remove unsolicited branding from generated output, and make the documented launcher match the shipped files.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

other

Error

Location: scripts/video.sh:28
Finding: Unconditional Promotional Content Injection into Generated Output
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/script.sh:215
Finding: Path Traversal in Script Save Function Allows Filesystem Writes Outside the Storage Directory
Content: View full analysis
}" cat > "$SCRIPTS_DIR/$name.md" echo "Saved: $SCRIPTS_DIR/$name.md" _log "save" "$name" } ``` ### Technical Analysis The `name` argument is controlled by the caller and is concatenated directly into a filesystem path. The implementation does not reject path separators, `..` traversal components, or symlink-based redirection. Because shell quoting only prevents word splitting and wildcard expansion, it does not prevent path traversal. A value containing enough `../` components can cause the destination to resolve outside `$SCRIPTS_DIR`. The forced `.md` suffix limits the names that can be targeted but does not prevent creation or replacement of writable Markdown files elsewhere. The use of `cat >` truncates an existing destination before writing. Consequently, a successful traversal can overwrite an existing file rather than merely creating a new one. ### Attack Path 1. Determine or infer the configured storage directory. By default, it is derived from: ```bash ${XDG_DATA_HOME:-$HOME/.local/share}/video-script-creator ``` 2. Invoke the `save` command with a traversal-based name, for example: ```bash printf 'attacker-controlled content\n' | bash scripts/script.sh save "../../../../target" ``` 3. The destination is constructed as: ```text $SCRIPTS_DIR/../../../../target.md ``` 4. The operating system resolves the traversal components outside the intended scripts directory. 5. If the resolved parent directory is writable, `cat >` creates or truncates the target Markdown file and writes attacker-controlled standard input into it. 6. A symlink already present at the destination can also redirect the write to another file accessible to the curre ...[truncated 513 chars]
Remediation: View remediation
&2 exit 1 } ``` - Explicitly reject `/`, backslashes, empty names, `.` components, and `..` components. - Canonicalize both the storage directory and destination, then verify that the destination remains beneath the canonical storage directory. - Reject symbolic links in both the destination and relevant parent components. - Avoid silently truncating existing files. Use no-clobber creation or require explicit overwrite confirmation. - Create the storage directory with restrictive permissions, such as mode `0700`, and saved files with mode `0600` where appropriate. - Add tests covering traversal strings, nested paths, symlink destinations, and overwrite attempts. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/script.sh:222
Finding: Path Traversal in Script Display Function Allows Reads Outside the Storage Directory
Content: View full analysis
}" local f="$SCRIPTS_DIR/$name.md" [ -f "$f" ] && cat "$f" || echo "Not found: $name" } ``` ### Technical Analysis The caller-controlled `name` is inserted directly into the file path without basename validation or canonical-path containment checks. Quoting the variable does not neutralize `../` traversal components. If the resulting path resolves to a regular file, `cat` prints its contents. An attacker can therefore escape `$SCRIPTS_DIR` and access readable Markdown files elsewhere on the local filesystem. Symbolic links can likewise redirect the read outside the expected directory. The `.md` suffix constrains the set of directly accessible filenames, but sensitive Markdown files may include project instructions, internal documentation, operational notes, or AI-agent context. ### Attack Path 1. Determine the relative path from `$SCRIPTS_DIR` to a readable Markdown file. 2. Invoke `show` with a traversal-based name, for example: ```bash bash scripts/script.sh show "../../../../project/INSTRUCTIONS" ``` 3. The function appends `.md` and constructs: ```text $SCRIPTS_DIR/../../../../project/INSTRUCTIONS.md ``` 4. The filesystem resolves the path outside the intended storage directory. 5. If the target exists, is a regular file, and is readable by the current user, `cat` writes its contents to standard output. 6. If an AI agent invoked the command, the disclosed content may subsequently be included in the agent's response or context. ### Impact Assessment The vulnerability can disclose any readable `.md` file reachable through traversal or a suitable symlink. This may expose local documentation, project instructions, or sensitive contextual informa ...[truncated 203 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (16)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The code generally aligns with the broad domain of video script creation, so its primary purpose is related to the description. However, the declared description significantly overstates what the tool actually does. The implementation is mostly a template-based command-line helper for outlines, intros, hooks, CTAs, timelines, briefs, thumbnails, and simple local storage. It does not implement complete script generation beyond reusing the outline command for 'script', does not implement real storyboard/shotlist generation, does not provide series planning or performance/data review, and does not generate titles/tags as advertised. Additionally, it has undeclared local persistence features: saving user content to disk, listing/showing saved scripts, and logging history. These are not malicious, but they are capabilities not reflected in the description. Therefore, this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The code is related to video scripting, so it is not wholly unrelated, but the implemented behavior is much narrower than the declared description. It only supports three commands: 'outline' for a fixed generic outline template, 'hook' for a few static hook templates, and 'thumbnail' for thumbnail tips. The declared purpose promises substantially broader functionality including full scripts, CTA generation, storyboards, series planning, and data review/analysis, none of which are implemented beyond minimal template text. This is a material description-behavior mismatch due to overstated capabilities and a different practical scope.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest description says the skill should be used for 'any platform' and lists many broad content-creation scenarios, ending with a generic trigger note. This makes invocation boundaries unclear and increases the chance the skill is selected for common creative-writing requests beyond a narrowly defined command or context.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The 'Use when' list ends with '任何与短视频脚本创作相关的任务' ('any task related to short-video script creation'), which is an open-ended catch-all rather than a specific trigger boundary. This provides little distinction between when this skill should activate and when a general-purpose writing skill should handle the request.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This file presents all instructions, examples, and the command usage note exclusively in Chinese. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly documented and justified, which it is not here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code file contains natural-language strings and descriptions entirely in Chinese, beginning with the skill description on L003. The skill does not offer any user opt-in or locale selection despite supporting a global platform like YouTube, which can violate a language/locale policy requiring user choice rather than a forced language.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation says script <topic> [duration] produces a 'Full script with timestamps', creating a clear expectation of richer functionality. However, the dispatcher routes script to cmd_outline, which only emits a generic outline rather than a full script, so the documented intent contradicts actual behavior.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest describes generating complete video scripts, titles, tags, CTAs, storyboards, series planning, and performance/data review across many use cases. In reality, the code only supports three simple commands: a fixed outline template, fixed hook templates, and a thumbnail checklist, with no implementation for titles, tags, storyboards, series planning, or data review.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The natural-language description is predominantly Chinese and centers on Chinese platforms and Chinese scripting terminology, but does not explicitly state that language choice will follow user preference. This can create a locale/language policy concern if the skill defaults users into a specific language without offering a choice.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The help output at L888 documents hook as generating 5 opening hooks, but the command dispatcher at L960-L961 calls gen_hooks_10, whose docstring and implementation generate 10 hooks. This is an active documentation-to-code contradiction rather than a mere omission.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The inline usage documentation claims shotlist <script-file> will 'Generate shot list from script'. In reality, the command handler only echoes 'Analyze script and generate shot list' and performs no analysis or generation, which is an active mismatch between documented intent and implementation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation states export <name> <format> supports exporting content in txt|md|csv formats. The dispatcher instead only echoes a string indicating the format and does not read a saved script or produce any exported output, contradicting the command description.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: cmd_save writes arbitrary user-provided stdin to a path derived from the user-controlled name argument with no validation or confirmation. This enables path traversal such as ../../... to overwrite files writable by the current user outside the intended data directory, which is more dangerous in an agent/skill context where parameters may be supplied indirectly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The _log function silently records command names and user-supplied arguments to history.log without disclosure or consent. In this skill's context, topics and script names may contain sensitive project ideas, campaign plans, or personal data, so unexpected persistence increases privacy and data-retention risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The skill is presented primarily as a video script generator, with examples centered on scripts, hooks, outlines, CTAs, planning, and analytics. The code includes a separate thumbnail-design checklist feature, which is adjacent to content creation but not clearly described as part of the operational scope implemented by this script.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file’s user-facing instructional content is written in Chinese, including the title and all tips, with no indication that the user can choose another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.