Back to skill

Security audit

Video Summarizer(视频摘录+Notion/Obsidian知识库存档)

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed video summarizer that uses cloud AI, cloud image storage, optional Notion publishing, and local Obsidian writes, so users should configure it carefully but the behavior matches its purpose.

Install only if you are comfortable sending video transcripts, metadata, audio when Groq is configured, screenshots, and cover images to the services you configure. Use dedicated least-privilege API keys, prefer a private dedicated OSS bucket, avoid sensitive or confidential videos, and remove the Bilibili cookie file when you no longer need authenticated subtitle access.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (22)

Tainted flow: 'share_url' from requests.get (line 106, network input) → requests.get (network output)

Medium
Category
Data Flow
Content
raise ValueError("未找到有效的分享链接")

        share_url = urls[0]
        share_response = requests.get(share_url, headers=HEADERS)
        video_id = share_response.url.split("?")[0].strip("/").split("/")[-1]
        share_url = f'https://www.iesdouyin.com/share/video/{video_id}'
Confidence
88% confidence
Finding
share_response = requests.get(share_url, headers=HEADERS)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill declares no explicit permissions even though its documented behavior clearly requires access to environment variables, local files, network services, and shell tools. This mismatch weakens user review and platform enforcement because a consumer may grant trust without understanding the actual capability scope, especially since the skill handles sensitive credentials and writes into local knowledge stores.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The documentation states that cover images are automatically uploaded to OSS, which introduces external data transfer beyond the skill's stated purpose of generating summaries for Obsidian and Notion. Even if the image is only a thumbnail, automatic third-party upload can expose user activity and content metadata without clear disclosure or consent.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The script transmits full subtitle transcripts and video metadata to a configurable external LLM endpoint via `LLMClient.from_env()` and `analyze_simple()`. This is a real data-exposure issue because the destination can be any OpenAI-compatible service, and users are not given a clear trust boundary, consent prompt, or minimization controls before potentially sensitive content leaves the local environment.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The script is explicitly designed to obtain and persist Bilibili account cookies, which grants authenticated session access. In the stated skill context of video summarization and publishing notes to Obsidian/Notion, collecting login cookies expands capabilities beyond simple summarization and introduces credential-handling risk if the cookies are later reused, exfiltrated, or mishandled.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
Invoking an external tool to perform interactive login and capture privileged session cookies gives the skill the ability to act as the user on Bilibili. That is sensitive functionality, and in this skill’s declared context it is not clearly justified, making it more dangerous because it introduces account-access capability unrelated to local summarization/output workflows.

Description-Behavior Mismatch

Medium
Confidence
81% confidence
Finding
The script uploads local audio content to Groq's remote transcription API, creating an external data disclosure path. In the skill context, remote transcription can be functionally related to summarization, but it becomes risky because the transfer is automatic and not clearly constrained or disclosed to the user at the point of use.

Description-Behavior Mismatch

Medium
Confidence
83% confidence
Finding
The skill advertises summarization into Obsidian and Notion, but this script also uploads screenshots and thumbnails to Alibaba Cloud OSS, expanding data egress beyond the stated destinations. That mismatch matters because screenshots and cover images can contain sensitive visual content, and users may not expect a third-party cloud bucket to receive them.

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
The code reads OSS credentials from environment files and performs standalone cloud-storage operations that are not inherent to generating a summary. This increases the attack surface and the chance of unintended exfiltration if the skill is run in an environment where users do not realize their local media will be sent to an external bucket.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The script uploads screenshots and cover images to OSS/public URLs, which is a real data-exfiltration capability beyond the stated Obsidian + Notion scope. Even if intended for image hosting, it transmits derived content from user videos to a third-party service and may expose private or copyrighted material through public links.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The README states that pushing to an Obsidian vault is enabled by default, but it does not clearly warn users that running the script will create or modify local files in a user-specified knowledge base. In a skill that processes arbitrary URLs and writes generated content automatically, this can lead to unexpected filesystem changes, accidental overwrite/clutter, or disclosure of sensitive local notes context if users do not realize local persistence is the default behavior.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The README advertises automatic Notion push as an option, but does not clearly warn that video-derived content, metadata, screenshots, and AI-generated summaries may be transmitted to third-party cloud services. Because this skill handles potentially sensitive user-selected content and integrates with external APIs, missing privacy and data-transfer disclosure increases the risk of unintentional exfiltration to SaaS platforms.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
Automatic upload of cover images to OSS is a privacy-relevant network action, but the documentation provides no warning about transmission, retention, or who can access the uploaded asset. This can lead to unintended disclosure of viewed content, associated metadata, or account-linked storage usage.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
Subtitle text and metadata are sent to an external LLM service without any in-script privacy warning, confirmation prompt, or retention notice. This is dangerous because transcripts may contain private, copyrighted, or confidential material, and the configurable base URL means the data could be routed to an untrusted third-party endpoint without the user's awareness.

Missing User Warnings

Low
Confidence
86% confidence
Finding
The script persists `ai_result.json` and generated Markdown summaries to disk automatically, but does not provide an explicit warning that analysis artifacts will be stored locally. This can leak sensitive transcript-derived content to shared machines, synced folders, backups, or downstream integrations such as Obsidian/Notion, especially when users assume processing is ephemeral.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The code uploads extracted audio content to Groq for transcription, but there is no explicit runtime consent, warning, or policy gate before sending potentially sensitive user media off-device. In a summarization skill handling personal or proprietary videos, this can create privacy and data-governance exposure even if the transmission is functionally intended.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The script uploads local markdown content, extracted metadata, URLs, author names, cover URLs, and parsed note content to Notion, but the execution path provides no explicit consent prompt or strong user-facing warning at push time about what data leaves the local machine. In this skill context, the file may contain private notes or sensitive source metadata, so silent cloud transmission increases privacy and data-handling risk.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
Audio files are transmitted to a remote API without an explicit user-facing warning or consent checkpoint in this script. Because audio may contain sensitive speech, personal data, or copyrighted material, silent cloud upload increases privacy and compliance risk.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The script sends screenshots and thumbnail data to OSS and requests public URLs without a clear user-facing warning at execution time. This creates an undisclosed outbound data flow that may surprise users and expose media-derived content externally.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
When enabled, the script reads Notion credentials and transmits summary content to Notion, but the code provides limited disclosure about what exact content is sent and how credentials are sourced. Because this is remote transmission of generated content using sensitive API keys, lack of explicit notice and consent granularity is a genuine security/privacy issue.

External Transmission

Medium
Category
Data Exfiltration
Content
timeout = self.timeout_base * (attempt + 1)
                print(f"   尝试 {attempt + 1}/{self.max_retries} (超时:{timeout}s)...")

                response = requests.post(
                    endpoint, headers=headers, json=body, timeout=timeout,
                )
Confidence
83% confidence
Finding
requests.post( endpoint, headers=headers, json=

External Transmission

Medium
Category
Data Exfiltration
Content
print("   🌐 使用 Groq API 转录...")
    
    url = "https://api.groq.com/openai/v1/audio/transcriptions"
    headers = {"Authorization": f"Bearer {GROQ_API_KEY}"}
    
    try:
Confidence
83% confidence
Finding
https://api.groq.com/

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.