PDF to Video

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:15 AM UTC
• Version: 1.0.0

Overview

The skill does what it claims, but it can make local or login-protected PDFs publicly reachable for a third-party video service without enough consent, access-control, or cleanup guidance.

Review before installing. Use this only with PDFs you are allowed to share externally, preferably already-public documents. For local or private PDFs, require explicit user approval, use short-lived private or presigned URLs instead of open public storage, delete or revoke access after processing, and check Revid's data handling and retention terms.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:15

Finding

Local PDFs Are Required to Be Uploaded to Public Storage

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15–16
Vulnerability Type: Excessive public data exposure
Risk Level: Medium

Vulnerable Code Snippet:

markdown

- For local PDFs the agent must first upload to public storage (S3, Supabase
  Storage, etc.) so Revid can fetch it.

Technical Analysis

The Skill instructs the agent to place local PDF documents in public storage so that the external Revid service can retrieve them. Public access is broader than the minimum privilege required for service-to-service document retrieval. A local PDF may contain confidential business information, personal data, unpublished research, or copyrighted material.

The instruction does not require explicit user consent, sensitivity classification, a short expiration period, access restrictions, or deletion after processing. Consequently, a document may remain publicly retrievable beyond the render operation. Although an attacker would generally need to discover, receive, or infer the object URL, public accessibility removes authentication as a protection once the URL is known.

Transmission of the API key to https://www.revid.ai and submission of a source URL to that service are consistent with the declared rendering workflow. The identified issue is specifically the requirement to expose local documents publicly rather than use a narrowly scoped transfer mechanism.

Attack Path

1. A user asks the agent to summarize a local PDF containing sensitive information.
2. Following SKILL.md, the agent uploads the PDF to an S3 bucket, Supabase Storage, or equivalent service with public read access.
3. The public URL is submitted to Revid for processing.
4. The URL is disclosed through logs, command history, render metadata, shared messages, referrer data, storage enumeration, or another unintended channel.
5. An unauthorized party uses the URL to retrieve the PDF without authentication.
6. If the object is ...[truncated 625 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer a direct, authenticated file-upload endpoint provided by the rendering service.
2. If URL-based retrieval is unavoidable, use a private storage object with a short-lived, unguessable presigned URL granting read-only access to that single object.
3. Set the URL expiration to the shortest practical render-ingestion window and revoke access immediately after retrieval or completion.
4. Automatically delete the uploaded object after processing, including on timeout and failure paths.
5. Obtain explicit user consent before transferring a local document to third-party infrastructure and clearly identify the recipient and retention implications.
6. Warn users not to upload secrets, credentials, regulated records, or other highly sensitive documents unless an approved protected transfer mechanism is available.
7. Avoid placing source URLs in logs, command output, analytics, or persistent conversation memory.
8. Document Revid's data-processing and retention behavior so users can make an informed decision before submission.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs agents to upload local PDFs to public storage so a third-party service can fetch them, but it provides no warning about confidentiality, access control, or retention risks. This can cause accidental disclosure of sensitive documents, especially because PDFs may contain proprietary, personal, or regulated data and the workflow normalizes making them publicly reachable.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · examples/run.sh (reported line 11)May include surrounding context.

sh

HERE="$(cd "$(dirname "$0")" && pwd)"
PAYLOAD=$(jq --arg u "$URL" '.source.url=$u' "$HERE/whitepaper.json")

PID=$(curl -fsS https://www.revid.ai/api/public/v3/render \
  -H "Content-Type: application/json" -H "key: $REVID_API_KEY" \
  -d "$PAYLOAD" | jq -r .pid)
echo "pid=$PID"

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This manifest hard-codes the output voice language to en-US, which is a natural-language locale constraint. Because the file does not indicate that the user can choose another language or that this is a justified region-specific workflow, it appears to impose a specific locale by default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill's natural-language configuration sets "language": "en-US", which forces a specific language/locale in the generated output. There is no nearby instruction that this is optional, user-selectable, or justified as a region-specific constraint, so it appears to violate the language/locale policy guidance.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.