Security audit

AI Short Video Script Generator Pro

Security checks for vulnerabilities and agentic risk

Overview

This paid AI script generator is not plainly malicious, but it needs Review because it embeds service credentials, exposes an unsafe debug server, and has unclear billing behavior.

Install only after the publisher fixes billing consent and pricing consistency, removes and rotates embedded API keys, disables Flask debug/all-interface binding for deployment, validates payment URLs, documents third-party AI data sharing, and escapes generated content before rendering.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/app.py:17
Finding: Hard-Coded Flask Signing Key and Third-Party API Credentials
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/app.py:243
Finding: Network-Exposed Flask Development Debugger
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: templates/index.html:123
Finding: Stored DOM Cross-Site Scripting Through Unescaped Script Content
Content: View full analysis
res.json()) .then(data => { const list = document.getElementById('scriptList'); if (data.scripts.length === 0) { list.innerHTML = '
No scripts yet
'; return; } list.innerHTML = ''; data.scripts.forEach(script => { const item = document.createElement('a'); item.className = 'list-group-item list-group-item-action'; item.href = 'javascript:;'; item.innerHTML = ` ${script.topic}
${script.platform} | ${script.duration}s | ${new Date(script.created_at).toLocaleString()} `; item.onclick = () => loadScript(script.id); list.appendChild(item); }); }); } // Render script function renderScript(script) { const result = document.getElementById('result'); result.innerHTML = `

🎣 3-Second Hook

${script.hook}

🎬 Shot List
${script.shots.map(shot => `
${shot.time}: ${shot.description}
`).join('')}

🎤 Voiceover

${script.voiceover}

📝 Subtitles

${script.subtitle}

🎵 Background Music

${script.bgm}

...[truncated 2538 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/app.py:151
Finding: Unvalidated Third-Party Payment URL Used for Redirects and Links
Content: View full analysis
🧪 Test Mode: Simulate Payment {% else %} 💳 Pay Now {% endif %} ``` ### Technical Analysis The application trusts `payment_url` returned by the remote billing API and uses it directly as both an HTTP redirect destination and an HTML link. It does not validate the URL scheme, hostname, port, credentials component, or destination path. Jinja escaping protects the HTML attribute syntax, but it does not establish that the URL is trustworthy. A URL pointing to an attacker-control ...[truncated 1540 chars]
Remediation: View remediation

other

Warning

Location: scripts/app.py:128
Finding: Advertised Pricing Does Not Match Implemented Billing Semantics
Content: View full analysis
Remediation: View remediation
`. 7. Implement the advertised lifetime-unlimited entitlement or remove that claim. 8. Add automated tests verifying the number, amount, timing, and idempotency of charges. 9. Present a clear confirmation to users before any charge is initiated. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared purpose and pricing do not match the reported behavior: the skill allegedly performs billing, persistent storage, and user/session tracking beyond what is clearly disclosed, and it also has a price mismatch. This is dangerous because users may be charged, tracked, or have data retained without informed consent, creating risks of deceptive billing, privacy violations, and ownership/access control issues around stored content.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The before_request hook triggers billing automatically for most endpoints before the user performs an explicit pay-confirmed action on that request. This is dangerous because users can incur charges merely by accessing functionality, without a clear charge-point confirmation or informed consent flow.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill advertises capabilities that imply networked/payment-backed behavior, but the manifest shown does not declare any explicit tool scope such as permissions or allowed-tools. Missing scope declarations reduce transparency and can allow reviewers or users to misunderstand what external actions the skill may perform, especially in a paid workflow that may contact remote services.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 77% confidence
Finding: This file includes user-facing natural-language content such as comments, error strings, and especially the AI prompt in Chinese, with no indication that users can choose another language or locale. Under the language/locale policy, forcing a specific language without opt-in can be a policy violation unless clearly justified as region-specific.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 99% confidence
Finding: A live API key is hardcoded directly in source code for the external AI service. Embedded secrets are highly dangerous because anyone with code access can reuse the credential for unauthorized API calls, incur cost, access associated account resources, or pivot into related systems if key scope is broad.
Content: Scanner excerpt · scripts/app.py (reported line 34)May include surrounding context.
python
# 硅基流动API配置 SILICONFLOW_API_KEY = 'sk-ggfjehtmwgthcdyajhpipxhurytmnmqsnvpfzoripdgdmzar' SILICONFLOW_API_URL = 'https://api.siliconflow.cn/v1/chat/completions' AI_MODEL = 'Doubao-ai/doubao-seed-v2-18k' # 初始化数据库

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: User-provided topic data is sent to a third-party AI API, but this code path contains no explicit privacy notice or consent mechanism. That creates a data-sharing risk, especially if users enter sensitive, personal, or proprietary content expecting local-only processing.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/app.py (reported line 105)May include surrounding context.
python
'max_tokens': 2000, 'response_format': {"type": "json_object"} } resp = requests.post(SILICONFLOW_API_URL, headers=headers, json=payload, timeout=30) data = resp.json() content = data['choices'][0]['message']['content'] return json.loads(content)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/app.py (reported line 131)May include surrounding context.
python
if TEST_MODE: return {"ok": True, "balance": 1000} try: resp = requests.post(f"{BILLING_URL}/charge", headers=HEADERS, json={ "user_id": user_id, "skill_id": SKILL_ID, "amount": 0.001, }, timeout=10) data = resp.json()

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest says the skill costs $0.005 per use, but the implemented billing endpoints use amount 0.001. This creates a billing-integrity issue: users may be charged a different amount than disclosed, and the discrepancy undermines consent and trust around payments.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/app.py (reported line 172)May include surrounding context.
python
if TEST_MODE: return redirect(url_for('index', test_payment='success')) try: resp = requests.post(f"{BILLING_URL}/payment-link", headers=HEADERS, json={ "user_id": user_id, "amount": 0.001, }, timeout=10) payment_url = resp.json().get("payment_url")

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The manifest describes an AI short video script generator, which clearly covers generating scripts, but the code also creates a database, stores generated scripts, lists prior scripts, retrieves individual saved scripts, and deletes them. Persistent CRUD management is additional behavior not reflected in the manifest description.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The HTML root sets lang="en", and the visible UI text throughout the page is English-only, with no indication that users can choose another language or that English is required for a region-specific purpose. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The template declares lang="en", which hard-codes English as the page language. Under the policy rule, forcing a specific language without user opt-in or documented regional justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

🎣 3-Second Hook

🎬 Shot List

🎤 Voiceover

📝 Subtitles

🎵 Background Music

T09 · Insecure Skill Coding Practices

other

SkillSpector

Tp4

Missing User Warnings

Undeclared Tool Scope

Natural-Language Policy Violations

External Transmission

Missing User Warnings

External Transmission

External Transmission

Description-Behavior Mismatch

External Transmission

Description-Behavior Mismatch

Natural-Language Policy Violations

Natural-Language Policy Violations

Static analysis