llm-video-generator

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 11:56 PM UTC
• Version: 1.0.1

Overview

This skill is a coherent ZhipuAI video-generation helper, with ordinary media-processing and API-use risks users should understand before installing.

Install only if you are comfortable sending video prompts and any provided images to ZhipuAI and storing task metadata locally. Use a virtual environment, pin/review `zai-sdk`, avoid sensitive images or prompts, and do not concatenate media files with untrusted or unusual filenames until the concat escaping issue is fixed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:204
• Finding: Unpinned Third-Party Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 204 **Vulnerability Type**: Supply-chain risk from an unpinned dependency **Risk Level**: Medium ### Vulnerable Code ```markdown - **Missing zai-sdk**: `pip install zai-sdk` (under anaconda) ``` ### Technical Analysis The Skill instructs users to install `zai-sdk` without specifying an exact version, integrity hash, or trusted package index. Consequently, the installed package and its transitive dependencies can change after the Skill has been reviewed. Python packages may execute package-controlled code during installation or when imported. If a future package release, transitive dependency, configured package index, or resolved distribution is compromised, following this instruction could execute malicious code under the privileges of the user running `pip`. The issue does not establish that the current `zai-sdk` package is malicious. The vulnerability is the absence of dependency pinning and integrity verification in the documented installation process. ### Attack Path 1. A user runs the video generation script without `zai-sdk` installed. 2. The import in `video_gen.py` fails, and the user follows the documented remediation command. 3. `pip` resolves the latest available package and dependencies from the user's configured package indexes. 4. An attacker who has compromised a resolved release, dependency, or package index supplies malicious package content. 5. Package installation or a subsequent import executes attacker-controlled code with the privileges of the user running the Skill. ### Impact Assessment Successful exploitation could execute arbitrary code in the Python environment and under the operating-system account performing the installation. Depending on that account's access, the attacker could read or modify project files, access environment variables such as `ZHIPU_API_KEY`, alter generated outputs, or compromise other resources available to the user. No privileg ...[truncated 103 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the mutable installation command with a reviewed, exact version: ```bash python -m pip install zai-sdk==<reviewed-version> ``` 2. Maintain dependencies in a locked requirements file that includes cryptographic hashes: ```text zai-sdk==<reviewed-version> --hash=sha256:<verified-hash> ``` Install it with: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Pin and review all transitive dependencies, preferably through a reproducible lockfile. 4. Explicitly configure an approved HTTPS package index rather than relying on arbitrary user-level pip configuration. 5. Perform installation in an isolated virtual environment with minimal permissions. 6. Add an update process that reviews new versions before changing the lockfile or hashes. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/concat_videos.py:25
• Finding: FFmpeg Concat Manifest Injection Through Unescaped Filenames<![CDATA[ ## Vulnerability Details **File Location**: `scripts/concat_videos.py`, lines 25–39 **Vulnerability Type**: Structured-file injection through unsafe filename interpolation **Risk Level**: Medium ### Vulnerable Code ```python # Create concat list file with tempfile.NamedTemporaryFile(mode="w", suffix=".txt", delete=False) as tmp: for f in input_files: tmp.write(f"file '{os.path.abspath(f)}'\n") list_path = tmp.name try: cmd = [ "ffmpeg", "-y", "-f", "concat", "-safe", "0", "-i", list_path, "-c", "copy", output_path ] ``` ### Technical Analysis Each caller-supplied input path is inserted directly into an FFmpeg concat-demuxer manifest. The implementation does not escape or reject apostrophes, backslashes, carriage returns, or newline characters that have syntactic meaning in the manifest format. Although `subprocess.run()` receives an argument list and therefore does not introduce shell-command injection, the temporary file is itself an interpreter input. A crafted filename can terminate or alter the generated `file` directive and inject additional manifest content. The use of `-safe 0` also permits absolute paths and removes FFmpeg's safe-path restrictions. The preceding `os.path.isfile()` check does not prevent this issue because supported filesystems can contain apostrophes and newline characters in filenames. An attacker must be able to create or influence the names of local media files passed through `--inputs`. ### Attack Path 1. An attacker creates or supplies a valid media file whose filename contains concat-manifest delimiters, such as an apostrophe and newline followed by an additional `file` directive. 2. The crafted path is passed to `concat_videos.py` through `--inputs`. 3. `os.path.isfile()` succeeds because the crafted filename exists. 4. The script writes the path into the temporary concat manifest without escaping its syntax-sensitive characters. 5. FFmpeg ...[truncated 832 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Reject filenames containing concat-syntax control characters, including carriage returns, newlines, null bytes, apostrophes, and unsafe backslash sequences. 2. Resolve every input with `os.path.realpath()` and require it to remain within an explicitly approved media directory. 3. Avoid `-safe 0` where possible. Use FFmpeg's safe-path mode and relative filenames rooted in a controlled working directory. 4. Encode paths according to FFmpeg's documented concat-demuxer escaping rules rather than interpolating them directly. 5. Prefer an approach that avoids a caller-influenced manifest, such as constructing a validated FFmpeg filter graph with each path passed as a separate subprocess argument. 6. Create the temporary manifest with restrictive permissions and ensure cleanup remains guaranteed. 7. Add regression tests covering filenames containing apostrophes, backslashes, newlines, and other parser-significant characters. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The description claims an AI-powered video generation skill with multiple input modalities and model-based continuation logic. The actual code only validates input file paths, writes an ffmpeg concat list, and invokes ffmpeg to merge existing video files. This is a materially different primary purpose: post-processing/combining videos rather than generating them. No AI generation, no ZhipuAI integration, and none of the declared creation capabilities are present.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This is a clear description-behavior mismatch. The declared purpose centers on generating videos via the ZhipuAI CogVideoX-3 model from prompts or images, with advanced generation features. The actual code does none of that: it accepts a path to an already-existing video file, invokes ffmpeg/ffprobe, and extracts the last frame to a PNG. While last-frame extraction could be a supporting helper inside a larger video-generation pipeline, the supplied code chunk by itself only implements frame extraction and not the declared primary functionality. Therefore the description does not accurately represent what this code chunk actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The code substantially matches the core declared purpose of generating videos via ZhipuAI CogVideoX-3 in text-to-video, image-to-video, and first/last-frame modes. However, the description overstates important capabilities that are not present in the implementation. Most notably, the code generates only a single task per invocation and even documents that each generation produces about 5 seconds of video; there is no logic to split longer requests, use last-frame continuation, or chain multiple calls. It also does not expose a duration argument. The rest of the behavior—polling, saving JSON metadata, converting local image files, and downloading the output video—is consistent supporting functionality rather than a mismatch. Because the missing long-video chaining is a material claimed feature, this should be flagged as a description-behavior mismatch.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill directs the agent to use shell commands, networked API calls, environment variables, and file creation/compression, but it declares no tool scope restrictions. In an agent environment, missing explicit permissions increases the chance of unintended command execution, file writes, or outbound requests if the skill is invoked inappropriately or manipulated through user-controlled inputs.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger text is broad enough to match many generic requests involving video creation or conversion, increasing the chance the skill is auto-invoked outside the user's intended context. Because the skill then instructs the agent to perform network calls, shell execution, and file handling, accidental invocation expands the attack surface and could lead to unnecessary external requests or file operations.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"-movflags", "+faststart",
                output_path
            ]
            result2 = subprocess.run(cmd_reencode, capture_output=True, text=True)
            if result2.returncode != 0:
                print(f"ERROR: ffmpeg concat failed:\n{result2.stderr}", file=sys.stderr)
                sys.exit(1)

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

output_path
    ]
    print(f"Extracting last frame from {video_path}...")
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        # Fallback: try without sseof (some videos are very short)
        cmd2 = [

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

output_path
    ]
    print(f"Extracting last frame from {video_path}...")
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        # Fallback: try without sseof (some videos are very short)
        cmd2 = [

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

output_path
        ]
        # Get frame count first
        probe = subprocess.run(
            ["ffprobe", "-v", "error", "-count_frames", "-select_streams", "v:0",
             "-show_entries", "stream=nb_read_frames", "-of", "csv=p=0", video_path],
            capture_output=True, text=True

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"-q:v", "2",
            output_path
        ]
        result2 = subprocess.run(cmd_fallback, capture_output=True, text=True)
        if result2.returncode != 0:
            print(f"ERROR: ffmpeg failed:\n{result2.stderr}", file=sys.stderr)
            sys.exit(1)

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The manifest explicitly advertises support for videos longer than 5 seconds via chained calls with last-frame continuation. In this file, each mode submits exactly one `client.videos.generations(...)` request, and there is no logic to segment duration, extract a last frame, or invoke follow-up generations to extend the video.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest says the skill supports configuring duration, but the CLI accepts prompt, quality, audio, size, fps, output directory, and polling controls only. No argument or API field is provided for duration, so users cannot actually control this capability as described.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill sends user prompts and optionally local image content to a third-party video-generation API, but the code provides no explicit disclosure or consent mechanism at the point of use. In an agent context, users may reasonably assume local files stay local, so silent transfer of potentially sensitive images or text to an external service creates a real privacy and data-governance risk.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The guidance says to use English prompts for best quality, which directs operation toward a specific language without offering user choice or opt-in. This can conflict with language/locale policy expectations when the user has provided input in another language.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The script persists task metadata and result JSON files containing the user's prompt and task identifiers to disk without warning or minimization. In shared environments, multi-user systems, or retained workspaces, these files can expose sensitive creative content or private prompts beyond the user's expectations.

Static analysis

No suspicious patterns detected.