T09 · Insecure Skill Coding Practices
Error
- Location
scripts/learn_design.py:403- Finding
Arbitrary Recursive Directory Deletion Through Reference ID Path Traversal
- Content
View full analysis
- Remediation
View remediation
Security audit
Video Podcast Maker
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent video-generation skill, but two helper scripts can write or recursively delete outside their intended project folders if given crafted IDs.
Install only if you are comfortable with a shell-driven media pipeline that writes project files and calls external TTS/media tools. Avoid passing untrusted asset IDs or design reference IDs, do not run design delete with --yes unless the preview path is clearly inside the intended reference folder, and prefer pinned dependencies or a locked environment before using the optional npx Hyperframes flow.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/assets.py:183- Finding
Arbitrary File Write Through Unsanitized Asset ID
- Content
View full analysis
/assets`. `Path` preserves traversal components until filesystem resolution. Consequently, an ID containing enough `../` components can escape both the `assets` directory and the video directory. The code then creates parent directories and copies the selected source file to the escaped destination. `shutil.copy2()` overwrites an existing destination file when permissions permit. The `--replace` option only governs replacement of an existing manifest entry with the same logical ID. It does not prevent filesystem ov ...[truncated 1666 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
references/hyperframes-overlays.md:42- Finding
Unpinned Runtime Package Execution and Non-Reproducible Dependency Resolution
- Content
View full analysis
=2.31.0,<3.0.0 edge-tts>=6.1.0,<7.0.0 azure-cognitiveservices-speech>=1.35.0,<2.0.0 dashscope>=1.17.0,<2.0.0 ``` No dependency lockfile was present in the audited project structure. ### Technical Analysis An unversioned `npx hyperframes` invocation can resolve the currently published package from the package registry when no suitable local binary is installed. The effective executable can therefore change after the Skill itself has been reviewed. Similarly, caret and bounded range declarations permit future package versions to be selected. Without a committed lockfile for Node dependencies or a hash-locked Python dependency set, two installations can resolve different dependency graphs. This is not evidence that any listed package is currently malicious. The security issue is that the au ...[truncated 1620 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (156)
Tainted flow: 'payload' from os.environ.get (line 58, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python }, } resp = requests.post(endpoint, headers=headers, json=payload, timeout=timeout_sec) resp.raise_for_status() data = resp.json()
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description promises a broad, user-facing video creation workflow from topic to final 4K narrated video, plus iterative rebuilds and possible visual pattern learning from references. The supplied code does something much narrower: it reads existing project files, parses subtitles and section markers, estimates/aligns slide start and end times, and rewrites timing.json with a backup. This is a supporting internal post-processing utility for timing correction, not the primary end-to-end capability described. While it does relate to narrated video production, the actual behavior is materially different in scope, trigger conditions, and outputs.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description presents a full automated narrated video creation/regeneration workflow. The supplied code does not implement that workflow. It only manages asset metadata for a video project directory via subcommands (init/add/list/validate), including copying asset files into an assets folder and validating manifest entries. While this could be a supporting component within a larger video pipeline, the code chunk's actual purpose is narrowly asset-manifest management, which is materially different from the declared primary purpose. Therefore this is a clear description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
There is a clear description-behavior mismatch. The declared purpose describes a full automated narrated knowledge-video creation/regeneration skill triggered by a user-provided topic or edits to an existing generated video. The actual code chunk does not research topics, write scripts, synthesize audio, render video, or rebuild outputs. Instead, it inspects existing project artifacts—Remotion .tsx beat arrays, timing.json, and podcast_audio.srt—and audits synchronization between on-screen text beats and subtitle timings. This is a narrow internal QA/validation utility for beat alignment, which is materially different from the declared end-user purpose of producing narrated explainer videos.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description presents a full automated narrated knowledge-video creation skill. The actual code chunk does not implement any of that core functionality; instead, it only checks whether required command-line tools and TTS-related environment variables are available before some other process runs. This is a materially different primary purpose. While prereq checking could be a supporting utility inside a larger video-generation project, this specific supplied code chunk by itself does not match the declared behavior of producing or iterating on narrated videos.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared purpose is a narrated knowledge-video creation skill. The actual code chunk does not research topics, generate scripts, synthesize speech, render video, process media, or reuse a videos directory. Instead, it checks whether the skill itself has a newer released version upstream and writes a .last_update_check timestamp. This is a materially different primary purpose and an undeclared capability unrelated to the user-facing triggers described. While update checking could be ancillary to a larger package, this specific chunk’s behavior does not match the declared skill description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
There is a clear description-behavior mismatch. The declared purpose describes an end-user skill for creating or regenerating narrated knowledge videos across platforms using a full pipeline (research → script → TTS → Remotion → MP4 + BGM). The actual code does none of that. It only provides helper functions for argparse format selection and emitting standardized JSON/prose success/error responses with metadata and exit codes. This is an internal support component for CLI tooling, not a video-podcast-making implementation. While such a module could support a larger video toolchain, this code chunk itself does not substantiate the declared primary purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The description claims an end-to-end automated topic-video creation/regeneration skill triggered by a user supplying a topic or requesting a narrated explainer/video podcast. This code does not implement that primary purpose. It assumes an already-created project directory with timing.json, podcast_audio.wav, and optionally podcast.txt; then it filters sections, extracts section audio, writes shorts metadata/stubs, and optionally renders vertical shorts. That is a materially different function: a post-processing/derivative shorts generator for an existing podcast/video project. While it is related to video production and uses Remotion, the implemented capability is much narrower and not accurately represented by the declared description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description is for an end-to-end narrated knowledge video generation skill. The supplied code chunk does not implement that behavior; it only retrieves nested user preference values and outputs them in prose or JSON. While such a helper could support a larger video pipeline, this chunk’s actual primary purpose is configuration lookup, which is materially different from the declared skill purpose. Therefore this is a description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a broad end-user skill whose main function is creating or regenerating narrated knowledge videos from a topic, with a production pipeline including research, scripting, TTS, Remotion, and MP4+BGM output. This code chunk does not do any of that. Its actual purpose is much narrower: preparing and organizing design reference assets for later analysis. It extracts frames from local videos, copies images, stores reports, and updates preference/style-profile metadata. While the description briefly mentions learning visual design patterns from a reference video/image, this script only covers that sub-function and even then does not perform analysis itself—it mainly prepares files and metadata. Because the primary declared purpose is video generation/rebuild, while the actual code is a reference-management utility with separate CRUD-like operations, this is a material description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description centers on an automated content/video creation workflow for narrated educational videos and iterative re-rendering of those videos. The actual code chunk is unrelated to video generation: it is a maintenance/migration script for a preferences JSON file. Its primary purpose is to read, transform, merge, and rewrite configuration data, with dry-run and confirmation behavior. This is a materially different purpose and capability set from the declared skill behavior, so the description does not accurately represent the supplied code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared purpose describes a full narrated-video production pipeline with specific trigger conditions and outputs. The actual code chunk does not implement any of that primary behavior. Instead, it performs a limited support task: resolving which TTS backend is available and printing its name. While this may be related to the broader system as a helper utility, the code chunk itself materially differs from the declared primary purpose and does not substantiate the described capabilities. Therefore this is a description-behavior mismatch for the supplied code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The description presents a broad skill for creating or regenerating complete narrated knowledge videos from a topic, including research, script creation, TTS, visual rendering, and final MP4 output. The actual code chunk is a narrow implementation detail: a TTS backend that converts text chunks into WAV audio via OpenAI's speech API and computes approximate word boundaries. While TTS is a supporting component of the declared workflow, this chunk by itself does not match the declared primary purpose and lacks most of the advertised functionality. Therefore, the description does not accurately represent what this supplied code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents the skill as an end-to-end automated narrated knowledge-video creator and regenerator across multiple platforms, including research, scripting, TTS, video rendering, and final MP4 production with music. The supplied code chunk does not implement that primary purpose. It only handles one supporting subtask: text-to-speech synthesis through a delegated ttsCN backend, plus ffmpeg audio normalization and retry/resume logic. There is no evidence here of topic intake, research, script generation, visual analysis, design-pattern learning from images/videos, Remotion rendering, background music handling, or MP4/video creation. While TTS is consistent as a supporting implementation detail within a larger video pipeline, this code chunk's actual behavior is materially narrower than the declared skill purpose, so the description does not accurately represent this specific code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
There is a clear description-behavior mismatch. The declared purpose describes a full narrated knowledge-video production pipeline, including research, scripting, TTS, Remotion rendering, BGM, and remaking existing video projects. The actual code chunk does none of that. It only inspects text with regexes, counts Chinese characters and English token patterns, and recommends one of two Azure voices based on content complexity, then prints an advisory. While TTS is mentioned in the declared pipeline, this code is merely a narrow helper for voice selection and does not itself implement the declared primary function. Therefore the code’s actual behavior is materially different and much narrower than the described skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description says this skill should be used to create or regenerate narrated knowledge videos from a user topic through a full production pipeline. However, the supplied code is specifically an end-of-pipeline verifier script. It checks whether expected files exist, validates video/audio/thumbnail specs, compares durations, inspects publish_info.md sections based on platform preferences, validates asset manifests and overlay properties, and can auto-create final_video.mp4 from existing upstream files. This is a materially different primary purpose: QA/validation of already-produced outputs, not generation or regeneration from a topic. While verification could be a supporting part of a larger video pipeline, this code chunk by itself does not implement the declared core functionality and instead exposes a distinct capability and trigger context (verifying an existing videos// directory).
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description is for a full narrated video creation pipeline, but the supplied code chunk is a simple frontend helper for icon lookup and emoji detection. Its primary purpose is materially different and unrelated to automated video generation or iteration. This is not merely a supporting implementation detail for the described skill based on the code shown; it exposes no behavior tied to research, narration, rendering, media handling, or project management.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Resolve `SKILL_DIR` to the directory containing this `SKILL.md`. If your agent exposes a built-in skill directory variable (e.g. `${CLAUDE_SKILL_DIR}`), map it
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md **`check_update.sh` output**:
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md * stuff all overlap frames into the first section. The corrected pattern is in `templates/Video.tsx`.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md * stuff all overlap frames into the first section. The corrected pattern is in `templates/Video.tsx`.
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
json { "name": "video-podcast-maker", "version": "3.0.0", "description": "Automated pipeline to create professional video podcasts from a topic", "engines": { "node": ">=18" }, "scripts": { "studio": "remotion studio src/remotion/index.ts", "render": "remotion render src/remotion/index.ts", "build": "remotion bundle src/remotion/index.ts" }, "dependencies": { "@remotion/cli": "^4.0.438", "@remotion/lottie": "^4.0.438", "@remotion/media-utils": "^4.0.438", "@remotion/paths": "^4.0.438", "@remotion/player": "^4.0.438", "@remotion/shapes": "^4.0.438", "@remotion/transitions": "^4.0.438", "lottie-
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md **Common codes**: - `code != 3000`: Non-success response. Check VOLCENGINE_APPID and VOLCENGINE_ACCESS_TOKEN. - HTTP 401/403: Invalid or expired access token. Regenerate at [Volcengine Console](https://console.volcengine.com/speech/service/8). - Timeout: Increase via `VOLCENGINE_TIMEOUT_SEC` env var (default: 60s).
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
ffmpeg -y -i videos/{name}/thumb_raw.png
-vf "scale=1200:900:force_original_aspect_ratio=increase,crop=1200:900"
videos/{name}/thumbnail_ai_4x3.png rm videos/{name}/thumb_raw.pngtext The default model (`qwen-image-2.0-pro`) renders legible Chinese title text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
The cleanup step uses shell glob deletion with a path built from
videos/{name}. If{name}is not strictly validated and safely quoted upstream, a crafted project name containing path traversal or shell-significant characters could cause deletion of files outside the intended working directory; the command is destructive and runs automatically in both modes, which increases risk.- Content
bash VIDEO_DIR="videos/{name}" # Safe to auto-clean: TTS intermediate files only rm -f "$VIDEO_DIR"/part_*.wav "$VIDEO_DIR"/concat_list.txt echo "✓ TTS temp files cleaned" echo "" echo "Kept (delete manually after confirming final_video.mp4):"
Static analysis
No suspicious patterns detected.