Security audit

AdsTurbo 视频精修 · AdsTurbo Video Cleanup

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent AdsTurbo video-editing integration, but it needs review because it can upload private media to a third-party service and remove attribution or context markers like watermarks and hardcoded subtitles.

Install only if users understand that media may be sent to AdsTurbo and turned into a public URL. Use it only for videos and assets the user owns or is authorized to modify, especially when removing watermarks, logos, subtitles, or other attribution/context markers. Avoid sensitive, confidential, regulated, or third-party media unless the service's retention and access terms are acceptable.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The module docstring is misleading because it asserts that edits do not change meaning while the tool explicitly supports object/logo/watermark removal and burnt-in subtitle stripping. In a media-processing context, this can cause users or downstream systems to underestimate the evidentiary and integrity risks of using the tool on journalistic, compliance, or forensic footage.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger phrases are broad enough to match common requests like improving quality, adding subtitles, or removing logos without sufficient guardrails. This increases the chance the skill is invoked in contexts involving copyrighted, sensitive, or third-party videos where external processing or deceptive modification may be inappropriate.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The Chinese trigger list mirrors the same problem: very common phrases can route ordinary requests into a workflow that uploads content to a third-party service and supports watermark/subtitle removal. Because the triggers lack exclusions or warning conditions, they can over-select this skill for risky or unauthorized content.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill states that only public URLs are accepted and describes upload/workspace flows, but it does not clearly warn the user that the video will be sent to and processed by an external service. This can cause unintentional disclosure of personal, proprietary, or regulated video content and associated metadata.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The Chinese section similarly omits a clear warning that user-provided videos are processed by a third-party service. This creates a privacy and compliance risk for Chinese-speaking users who may not realize their content leaves the local environment.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The document instructs operators to upload local images, audio, and other files to a remote service and emphasizes doing so 'every time,' but it does not warn that this may disclose sensitive local data to a third party or make assets publicly accessible by URL. In this context, the omission can lead users to unintentionally expose private media, biometric voice samples, or proprietary files, especially because the generated URL is intended for downstream reuse.

Ssd 4

Medium

Confidence: 97% confidence
Finding: The skill explicitly promotes removing watermarks, logos, and burned-in subtitles while presenting the result as merely making a video 'cleaner.' Those features are often ownership, attribution, or contextual markers, so normalizing their removal materially enables deceptive republishing, copyright evasion, and misattribution of third-party content.

Ssd 4

Medium

Confidence: 96% confidence
Finding: The recommended sequence of erasing hardcoded subtitles and then adding translated subtitles provides a ready-made workflow for re-presenting someone else's video in another language while stripping original context. This materially lowers the barrier to deceptive localization, unauthorized redistribution, and manipulation of provenance cues.

Ssd 4

Medium

Confidence: 96% confidence
Finding: The Chinese section repeats the same staged process of removing embedded subtitles and re-subtitling for export, reinforcing a practical pattern for deceptive reuse across languages. Repetition in both languages broadens accessibility of the misuse pathway and makes the risky workflow more operational.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.28.0
Confidence: 93% confidence
Finding: The dependency is specified with a lower-bound range (`requests>=2.28.0`) instead of an exact pinned version, which makes installs non-reproducible and can unintentionally pull in insecure or breaking versions depending on resolver behavior and environment. In security-sensitive automation or agent skills, this increases supply-chain risk and complicates vulnerability management and incident response.

Known Vulnerable Dependency: requests==2.28.0 — 8 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +5 more

High

Category: Supply Chain
Confidence: 72% confidence
Finding: Although the file does not explicitly pin `requests==2.28.0`, the declared specifier allows installation of 2.28.0, which is a version with multiple known advisories. If dependency resolution or a cached environment selects that vulnerable version, the skill may inherit issues such as credential leakage or TLS/session verification problems.

Static analysis

No suspicious patterns detected.