Future Video Render

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:57 AM UTC
• Version: 1.0.1

Overview

The skill mostly matches its video-rendering purpose, but it needs review because its fallback script can send a wallet-backed API key and uploaded files to any custom HTTP(S) host when a custom-host opt-in is enabled.

Review this skill before installing if you use account mode. Keep the default production endpoint, avoid setting FVS_ALLOW_CUSTOM_AGENT_HOST or --allow-custom-host unless you fully trust the backend, and do not use plaintext remote HTTP with a production wallet-backed API key. Confirm every paid render and every local file upload before submission.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/future_video_render.py:226

Finding

API Key Can Be Transmitted Over Plaintext HTTP to an Arbitrary Custom Host

Content

View full analysis

Vulnerability Details

File Location: scripts/future_video_render.py:226-233, with credential attachment at scripts/future_video_render.py:354-375
Vulnerability Type: Insufficient transport security for sensitive credentials
Risk Level: Medium

Vulnerable Code

python

def validate_agent_origin(parsed: urllib.parse.ParseResult, *, allow_custom_host: bool) -> None:
    host = (parsed.hostname or "").lower()
    if parsed.scheme == "https" and host in ALLOWED_AGENT_HOSTS:
        return
    if allow_custom_host:
        return
    allowed = ", ".join(sorted(ALLOWED_AGENT_HOSTS))
    raise RenderToolError(
        f"refusing to send an API key to {parsed.geturl()}; expected HTTPS host in {allowed}. "
        f"For trusted local or staging FVS backends, pass --allow-custom-host or set {CUSTOM_HOST_ENV}=1."
    )

The accepted URL is subsequently used with the API key attached:

python

def request_json_api(
    *,
    url: str,
    method: str,
    api_key: str,
    agent_base: str,
    body: bytes | None = None,
    content_type: str | None = None,
) -> dict:
    url = validate_api_request_url(url, agent_base=agent_base)
    headers = {
        "X-FVS-Agent-Key": api_key,
        "Accept": "application/json",
    }
    if content_type:
        headers["Content-Type"] = content_type
    request = urllib.request.Request(url=url, data=body, headers=headers, method=method)
    try:
        with urllib.request.urlopen(request, timeout=120) as response:
            raw = response.read()

Technical Analysis

The default configuration appropriately restricts credential transmission to the HTTPS production host app.future.video. However, setting --allow-custom-host or FVS_ALLOW_CUSTOM_AGENT_HOST=1 causes validate_agent_origin to accept any absolute HTTP or HTTPS origin, including a non-loopback plaintext HTTP endpoint.

request_json_api uncon ...[truncated 2219 chars]

Remediation

View remediation

Remediation Suggestions

1. Require HTTPS for every custom host except explicitly recognized loopback addresses.
2. If local development requires plaintext HTTP, permit it only for validated loopback hosts such as 127.0.0.1, ::1, or localhost; do not rely on a general custom-host bypass.
3. Separate the controls for hostname override and insecure transport. For example, use --allow-custom-host for custom HTTPS hosts and a distinct, strongly warned --allow-insecure-loopback-http option for local testing.
4. Reject URLs containing user information and normalize ports and hostnames before origin comparison.
5. Display the final credential destination and require explicit confirmation before sending a production API key to a non-production host.
6. Recommend separate, least-privileged staging credentials and prevent production wallet-backed credentials from being used with insecure development endpoints.
7. Add automated tests confirming that custom remote HTTP origins are rejected even when custom-host mode is enabled, while explicitly approved loopback development cases behave as intended.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Tainted flow: 'request' from os.getenv (line 370, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/future_video_render.py (reported line 372)May include surrounding context.

python

headers["Content-Type"] = content_type
    request = urllib.request.Request(url=url, data=body, headers=headers, method=method)
    try:
        with urllib.request.urlopen(request, timeout=120) as response:
            raw = response.read()
    except urllib.error.HTTPError as exc:
        raw = exc.read()

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The code substantially matches part of the description: it submits render jobs, supports local asset uploads, polls until terminal/review states, checks status, and cancels running jobs. However, the declared purpose claims broader functionality that is not present in the code. Every command requires an API key via --api-key or FVS_AGENT_API_KEY, so there is no implemented no-account Link quote/pay-per-render mode. There are no endpoints or logic for obtaining quotes, making payments, downloading completed video binaries, or producing/returning signed final video URLs. The script only prints or writes JSON API responses. Thus the description overstates important user-facing capabilities beyond what the code actually does, creating a material description/behavior mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill exposes capabilities involving environment variables, local file access, file writes, and network access, but it does not declare any explicit tool scope such as permissions or allowed-tools. That omission weakens least-privilege boundaries and can let a consuming agent invoke broader capabilities than a reviewer or user would expect, especially in a skill that handles API keys, uploads local files, and contacts remote endpoints.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md

3. Before account-mode submission, show the user the render summary, requested duration/resolution, any available estimate or budget cap, and ask for explicit approval to spend FVS wallet credits.
4. If no key is available or the user wants a visible price before paying, use pay-per-render mode with `fvs_create_paid_render_quote`.
5. Default the app origin to `https://app.future.video` unless a trusted local or staging FVS environment is explicitly configured.
6. Never ask the user for raw card details. Link payment authorization must happen through the returned Link/MPP payment URL or an approved agent payment tool.

## Quick Workflow

Static analysis

No suspicious patterns detected.