Security audit

Short Video Script Creator

Security checks for vulnerabilities and agentic risk

Overview

This script-writing skill has a real confidentiality risk because it can read user documents, print them to logs, and send them to a hard-coded third-party model API with an embedded API key.

Review this skill carefully before installing. Do not use it with confidential customer, strategy, meeting, product, or competitor documents unless you are comfortable with the full contents being logged locally, saved under the skill output directory, and potentially sent to the hard-coded external model service. The embedded API key should be treated as compromised and replaced with user-managed credentials before use.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/main.py:17
Finding: Undisclosed Transmission of Sensitive User Documents to a Third-Party API<![CDATA[ ## Vulnerability Details **File Location**: `scripts/main.py:17, 105-119, 178-180, 35-47` **Vulnerability Type**: Sensitive data exposure to an external service **Risk Level**: High ### Vulnerable Code ```python API_URL = "https://api2.aigcbest.top/v1/chat/completions" ``` ```python # Read all supplied files battle_map_content = read_file_content(args.battle_map_file) meeting_notes_content = read_file_content(args.meeting_notes_file) product_info_content = read_file_content(args.product_info_file) benchmark_content = read_file_content(args.benchmark_script_file) competitor_content = read_file_content(args.competitor_script_file) historical_content = "" if args.historical_script_files: for f in args.historical_script_files: content = read_file_content(f) if content: historical_content += f"\n--- Historical script: {os.path.basename(f)} ---\n{content}\n" ``` ```python if args.call_model: messages = [{"role": "user", "content": prompt}] try: generated_scripts = asyncio.run(model_gpt(messages)) ``` ```python async with session.post( API_URL, headers={ 'Authorization': f'Bearer {API_KEY}', 'Content-Type': 'application/json' }, data=json.dumps({ "model": model, "messages": message_list, "max_tokens": 12000, "temperature": 0 }), timeout=999 ) as response: ``` ### Technical Analysis The application reads the complete contents of battle maps, meeting notes, product descriptions, benchmark scripts, competitor scripts, historical scripts, and other user-provided information. These values are incorporated into a single prompt and sent to the hard-coded external endpoint `api2.aigcbest.top`. The skill documentation only describes `--call-model` as directly invoking a model. It does not identify the external recipient, explain which information will leave the local system, describe retention ...[truncated 1602 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Clearly disclose the external API hostname, provider identity, transmitted data categories, retention policy, and privacy implications before execution. 2. Require explicit, informed user approval immediately before any network transmission. 3. Make the model endpoint configurable and restrict it to an administrator-approved provider allowlist. 4. Add a local-only mode that never transmits document contents. 5. Minimize the transmitted data and redact secrets, personal information, and confidential metadata before constructing the request. 6. Display a redacted transmission preview showing which files and fields will be sent. 7. Apply transport and provider-security controls, including certificate validation, contractual data-processing safeguards, and documented retention limits. 8. Reject model invocation when the destination has not been explicitly configured and approved. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/main.py:18
Finding: Hard-Coded API Credential Exposed in Source Code<![CDATA[ ## Vulnerability Details **File Location**: `scripts/main.py:18, 39` **Vulnerability Type**: Embedded secret and credential exposure **Risk Level**: High ### Vulnerable Code ```python API_KEY = "sk-uXiErnJimD8brHcWWzeL7tW5ILogfSFcNnTLGgel66j8y5c9" ``` ```python headers={ 'Authorization': f'Bearer {API_KEY}', 'Content-Type': 'application/json' }, ``` ### Technical Analysis A usable-looking API key is embedded directly in the distributed Python source. Any person or process that can download, inspect, archive, or scan the project can recover the credential without executing the application. Because the package metadata marks the package as non-private, distribution could expose the key to an unrestricted audience. A single shared credential also prevents per-user attribution, least-privilege enforcement, safe tenant separation, and independent credential rotation. ### Attack Path 1. An attacker obtains a copy of the project from its package, repository, artifact archive, or deployment directory. 2. The attacker opens `scripts/main.py` or uses an automated secret scanner. 3. The attacker extracts the hard-coded bearer token. 4. The attacker submits requests to the configured API using the recovered credential. 5. Requests are charged to or attributed to the credential owner until the key is revoked, expires, or reaches its quota. 6. If the key has broader provider permissions than model invocation, the attacker may exercise those additional permissions within the key's authorization scope. ### Impact Assessment An attacker may gain all API privileges assigned to the exposed key. Potential consequences include unauthorized model use, quota exhaustion, financial charges, service disruption, abuse attributed to the legitimate owner, and access to any additional API operations permitted by the credential. The finding does not establish local system compromise. Its privilege scope is limited to the permissions granted by the exposed API cred ...[truncated 84 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Revoke and rotate the exposed key immediately; deleting it from the current source alone is insufficient. 2. Review provider access logs for unauthorized use from the date the key was introduced. 3. Remove the credential from the source and all repository history, package archives, build logs, and released artifacts. 4. Load credentials from a secret manager, protected environment variable, or operating-system credential store. 5. Require each deployment or user to provide a separate credential with the minimum necessary permissions. 6. Add automated secret scanning to pre-commit hooks and CI pipelines. 7. Configure quotas, spending limits, expiration, source restrictions, and monitoring for replacement credentials. 8. Ensure error messages and debug output never print authorization headers or secret values. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/main.py:121
Finding: Complete Sensitive Prompt Contents Printed to Standard Output<![CDATA[ ## Vulnerability Details **File Location**: `scripts/main.py:121` **Vulnerability Type**: Sensitive information exposure through logging **Risk Level**: Medium ### Vulnerable Code ```python print(replacements) ``` The printed `replacements` object contains values assembled immediately beforehand: ```python replacements = { "{{name}}": args.name if args.name else "Pending", "{{customer_background}}": args.customer_background, "{{product_info}}": args.product_info if args.product_info else "", "{{product_info_content}}": product_info_content, "{{battle_map_content}}": battle_map_content, "{{meeting_notes_content}}": meeting_notes_content, "{{benchmark_content}}": benchmark_content, "{{competitor_content}}": competitor_content, "{{historical_content}}": historical_content, "{{count}}": str(args.count), "{{min_words}}": str(args.min_words), "{{max_words}}": str(args.max_words), "{{extra_requirements}}": args.extra_requirements if args.extra_requirements else "No additional requirements.", } print(replacements) ``` ### Technical Analysis The code prints the complete template-replacement dictionary to standard output. This dictionary contains all extracted source documents and direct user inputs, not merely diagnostic metadata. Standard output is commonly captured by CI systems, agent runtimes, container platforms, shell redirection, monitoring infrastructure, support tooling, and centralized log collectors. Consequently, confidential data can be copied into systems with wider access and longer retention than the original files. The statement executes unconditionally during prompt construction, including when `--call-model` is not used. Therefore, selecting a nominally local workflow does not prevent the logging exposure. ### Attack Path 1. A user invokes the skill with confidential input files or sensitive command-line values. 2. `build_prompt()` reads the complete contents of those inputs. 3. Th ...[truncated 850 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `print(replacements)` from production code. 2. If diagnostics are required, log only non-sensitive metadata such as input count, file extensions, content lengths, and operation status. 3. Place diagnostic logging behind an explicit debug option that is disabled by default. 4. Redact document contents, customer data, credentials, authorization headers, and prompt text from all logs. 5. Configure restrictive permissions and short retention periods for application and agent logs. 6. Audit existing logs and build artifacts for previously captured sensitive content, then securely delete or restrict affected records. 7. Add tests that verify sensitive marker values never appear in standard output or standard error. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/main.py:147
Finding: Documented User-Confirmation Security Gate Is Not Enforced<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:25-28`; `scripts/main.py:147-207` **Vulnerability Type**: Missing authorization and consent enforcement **Risk Level**: Medium ### Vulnerable Documentation and Code The documented workflow states that execution must pause until explicit confirmation: ```markdown 1. Build parameters: After receiving a generation instruction, all requirements and files are mapped to the parameter list. 2. Submit for review: Before executing any operation, the organized parameter list is sent to the user for review. 3. Wait for confirmation: Execution pauses until the user explicitly says "OK" or "continue." 4. Execute generation: The script starts only after confirmation is received. ``` The implementation proceeds directly after argument parsing: ```python args = parser.parse_args() print("args0", args) try: prompt = build_prompt(args) # Ensure output directory exists ensure_dir(DEFAULT_OUTPUT_DIR) timestamp = datetime.datetime.now().strftime("%Y%m%d_%H%M%S") ip_name_part = f"{args.name}_" if args.name else "" prompt_filename = f"prompt_{ip_name_part}{timestamp}.md" prompt_path = DEFAULT_OUTPUT_DIR / prompt_filename with open(prompt_path, 'w', encoding='utf-8', errors='ignore') as f: f.write(prompt) if args.call_model: messages = [{"role": "user", "content": prompt}] try: generated_scripts = asyncio.run(model_gpt(messages)) ``` ### Technical Analysis The security-relevant workflow described in `SKILL.md` is not implemented in the executable code. There is no parameter-review screen, confirmation prompt, approval token, or state transition proving that the user reviewed the inputs and authorized execution. When `--call-model` is present, the program constructs the prompt and invokes the external model immediately. This creates a discrepancy between the represented behavior and actual behavior. Users and calling agents may rely on a con ...[truncated 1268 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Implement a mandatory review stage that displays a redacted summary of all parameters, files, destinations, and planned operations. 2. Require explicit confirmation after the review and before reading sensitive files, writing prompts, or making network requests. 3. For non-interactive execution, require a short-lived approval token or a separate explicit consent flag generated only after review. 4. Do not treat the presence of `--call-model` alone as informed authorization to transmit document contents. 5. Record an auditable approval event containing the timestamp, approved destination, file list, and data categories without storing sensitive contents. 6. Fail closed when confirmation cannot be obtained. 7. If approval is intended to be enforced exclusively by an external agent, state that limitation clearly and ensure the calling framework technically enforces it rather than relying on prose. 8. Add integration tests proving that model invocation and prompt persistence cannot occur before confirmation. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This is a serious description-behavior mismatch: the skill is presented as a script-writing tool, but the detected behavior includes sending user inputs and document contents to a third-party model API, using undeclared remote network access, hardcoded credentials, and writing prompts/results to a fixed local directory. In this context, the skill processes potentially sensitive business documents such as product files, strategy maps, and historical scripts, so silent exfiltration and unsafe secret handling materially increase confidentiality and operational risk.

Hidden Instructions

High

Category: Prompt Injection
Content: 好的，任务收到。作为顶级的IP文案策划师，我将立即进入“小麦”的角色，根据你提供的全部信息，进行纯粹的原创。 **【口吻分析与提炼】**
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill advertises file and model-driven behavior but declares no tool scope or permissions, while the analyzed capability set indicates file read, file write, and network access. That combination is dangerous because users are not given an explicit trust boundary: local documents may be read, prompt/result data may be written to disk, and content may be sent off-host without transparent authorization.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The manifest description, usage guidance, and embedded prompt template are entirely written in Chinese and assume Chinese output conventions, but the file does not state that the skill is intentionally limited to Chinese users or offer any language/locale opt-in. This creates a natural-language policy issue because the skill effectively enforces a specific language without user choice.

Natural-Language Policy Violations

Medium

Confidence: 87% confidence
Finding: The instructions define the skill entirely in Chinese and direct the model to produce final output in that language and format, with no indication that the user can choose another language. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The file begins with Chinese-only natural-language instructions and states the assistant will immediately enter the role and respond in that style, with no indication that another language is available on request. This creates a language/locale policy concern because the skill appears to impose a specific language without user opt-in or a documented regional justification.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill reads potentially sensitive local files such as meeting notes, product documents, competitor scripts, and historical copy, then packages that content into prompts sent to an external model API. In a content-generation skill, this is dangerous because it can exfiltrate confidential business information beyond what users may reasonably expect from the description.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The model API request sends file-derived user content to a remote endpoint without any in-code warning, consent flow, or disclosure. Because the skill is specifically designed to ingest internal business materials, silent transmission to a third party raises significant confidentiality and compliance risks.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The code prints the full replacements dictionary, which includes raw contents extracted from user-supplied files and prompt fields. This can leak sensitive business data into terminal logs, CI logs, shell history captures, or host monitoring systems even if the model call is never made.

Natural-Language Policy Violations

Low

Confidence: 90% confidence
Finding: The package description is written entirely in Chinese and presents the skill's behavior in that locale without any indication that users can choose another language. Per the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Low

Confidence: 88% confidence
Finding: The file contains user-facing descriptions, comments, and error/help text in Chinese, and the CLI experience appears fixed to that language. There is no indication that the user can opt into another language or locale, which may violate a language-choice policy.

Static analysis

No suspicious patterns detected.