Security audit

Jianying Auto Editor

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its cloud video-editing purpose, but it has unsafe handling of credentials, local file metadata, and cloud-controlled output paths that users should review before installing.

Review this skill before use. Only point material_path at a minimal folder, do not use the default HTTP endpoint with a real API key, prefer a trusted HTTPS API, pin the package version if using npx, and treat the configured cloud service as receiving filenames, paths, media metadata, task settings, and execution reports. The author should sanitize outbound material records and validate cloud task IDs before this is suitable for routine use.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: examples/config.example.json:2
Finding: Default Plaintext HTTP Endpoint Exposes API Credentials and Project Metadata
Content: View full analysis
controller.abort(), this.timeoutMs); try { const response = await fetch(url, { method, headers: { 'content-type': 'application/json', 'authorization': `Bearer ${this.apiKey}`, 'user-agent': 'jianying-auto-editor/0.1.0' }, body: body === undefined ? undefined : JSON.stringify(body), signal: controller.signal }); const text = await response.text(); const parsed = text ? ...[truncated 2536 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/index.js:125
Finding: Absolute Local Filesystem Paths Are Unnecessarily Disclosed to the Cloud API
Content: View full analysis
null); if (!rootStats || !rootStats.isDirectory()) { throw new Error(`material_path does not exist or is not a directory: ${rootDir}`); } const results = []; async function walk(currentDir) { const entries = await fsp.readdir(currentDir, { withFileTypes: true }); entries.sort((left, right) => left.name.localeCompare(right.name)); for (const entry of entries) { const fullPath = path.join(currentDir, entry.name); if (entry.isDirectory()) { await walk(fullPath); continue; } const extension = path.extname(entry.name).toLowerCase(); if (!MEDIA_EXTENSIONS.has(extension)) { continue; } const stats = await fsp.stat(fullPath); results.push({ id: crypto.createHash('sha1').update(fullPath).digest('hex').slice(0, 12), name: entry.name, extension, kind: classifyMedia(extension), absolutePath: fullPath, relativePath: path.relative(rootDir, fullPath).replace(/\\/g, '/'), sizeBytes: stats.size, modifiedAt: stats.mtime.toISOString() }); } } await walk(rootDir); return results; } ``` The complete records are sent to the material-index endpoint: ```js await api.post(`/v1/tasks/${encodeURIComponent(taskId)}/material-index`, { materials, summary: buildMaterialSummary(materials) }); ``` They are sent again when requesting a plan: ```js async function fetchPlanBundle(api, taskId, config, materials) { let response = await api.post(`/v1/tasks/${encodeURIComponent(taskId) ...[truncated 2775 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/index.js:305
Finding: Cloud-Controlled Task Identifier Enables Output-Directory Path Traversal
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 86% confidence
Finding: The README instructs users to run the package via npx jianying-auto-editor without pinning a specific version. That causes execution of whatever version is currently published, creating a supply-chain risk if a malicious or compromised release is pushed later. In this skill context, the tool has access to local media paths, API credentials, and writable output locations, so unpinned execution is more dangerous than for a harmless read-only utility.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README explicitly describes scanning a local material directory, sending task/material data to cloud endpoints, and posting an execution report back, but it does not clearly warn users that local content metadata and possibly sensitive project information leave the device. This omission can lead to unintentional data exposure, especially because users may assume a local editing helper only works on-device. The context increases risk because the skill is designed around local media workflows, where filenames, paths, and associated metadata may reveal private or proprietary information.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill clearly instructs the agent to access local files, use networked cloud APIs, and potentially handle API keys, but it does not declare an explicit tool scope such as allowed-tools or permissions. This creates a trust-boundary problem: a caller may invoke the skill without clear visibility into its need for filesystem and network access, increasing the risk of unintended data exposure or overbroad agent execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill description and workflow indicate that it recursively scans a local media directory, uploads a material index to a cloud API, and sends an execution report back to the cloud, but this data transfer is not prominently disclosed as a privacy/security warning. Users may reasonably expect local draft generation only, and could unknowingly expose sensitive filenames, metadata, directory structure, or workflow details to a remote service.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The value "auto-cn" hard-codes a specific language/locale in the configuration, which is a natural-language policy concern when no opt-in or alternative language selection is presented. In this file there is no indication that the locale restriction is optional, user-selected, or justified as region-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest explicitly combines local media scanning, cloud API requests, and local draft output, but it does not warn that local files and metadata may be transmitted to a remote service. In a video-editing workflow, media folders often contain sensitive personal or business content, so lack of explicit disclosure can lead to unintended exfiltration of private data to a third-party endpoint configured by the user or operator.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This manifest describes broad capabilities such as scanning local media, requesting cloud editing plans, and generating output packages, but it does not define when the skill should be invoked or what requests should or should not trigger it. In manifest files, missing specificity around invocation scope can lead to unintended activation by overlapping generic video-editing requests.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access, suspicious.install_untrusted_source

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/index.js:14

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: examples/config.example.json:2