Ai Video Gen Pro

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:41 AM UTC
• Version: 1.0.0

Overview

The video-generation skill is coherent, but it recommends unpinned commands that can install mutable third-party skills and gives only light warning about sending media to external services.

Install only if you are comfortable using inference.sh and sending prompts, image URLs, audio URLs, or video URLs to that external service. Avoid copy-pasting the related npx skills add commands unless you have verified the source and can pin or otherwise trust the exact version being installed, especially for skills that may change future agent behavior or post to external accounts.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:154

Finding

Unpinned Third-Party Skill Installation Commands

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 154–175
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

bash

## Related Skills

```bash
# Full platform skill (all 150+ apps)
npx skills add inference-sh/skills@infsh-cli

# Pruna P-Video (fast & economical)
npx skills add inference-sh/skills@p-video

# Google Veo specific
npx skills add inference-sh/skills@google-veo

# AI avatars & lipsync
npx skills add inference-sh/skills@ai-avatar-video

# Text-to-speech (for video narration)
npx skills add inference-sh/skills@text-to-speech

# Image generation (for image-to-video)
npx skills add inference-sh/skills@ai-image-generation

# Twitter (post videos)
npx skills add inference-sh/skills@twitter-automation

Technical Analysis

The documentation recommends installing multiple third-party skills through npx without pinning them to reviewed package versions or immutable source commits. Consequently, the content installed when a user executes these commands can differ from the content available when this skill was audited.

This creates a supply-chain trust boundary: compromise of the package resolution path, the upstream repository or publisher account, or a later malicious upstream change could cause users to install attacker-controlled skill instructions or executable components. The artifact does not itself contain a malicious payload, and exploitation depends on a user or agent executing one of the documented installation commands.

A related concern appears at SKILL.md:15, where installation instructions are linked from a mutable main branch. That link is not directly executed by the skill, but its contents can change after review and could later recommend unsafe commands.

Attack Path

1. An attacker compromises an upstream skill source, publisher account, repository, or relevant package-resolution channel.
2. The attacker modifies one of the unpinned skills or its installation beha ...[truncated 1010 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every recommended dependency to a reviewed, immutable version or commit rather than a mutable name or branch.
2. Prefer commands that resolve exact package versions, release tags backed by immutable artifacts, or full commit hashes.
3. Publish and verify cryptographic checksums or signed provenance for downloaded and installed artifacts.
4. Replace the mutable main-branch installation link at SKILL.md:15 with a versioned document or immutable commit URL.
5. Review each related skill's source, installation hooks, transitive dependencies, and requested tool permissions before recommending it.
6. Use lockfiles or an equivalent integrity mechanism where the installer supports them.
7. Run third-party installation and generation tooling under least privilege, with restricted filesystem, credential, and network access.
8. Clearly warn users that the listed commands retrieve third-party content and require independent trust verification before execution.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger list contains broad phrases such as video generation, generate video, and ai animation, which can match many ordinary user requests. Overbroad activation increases the chance the skill is invoked unexpectedly, causing unintentional external calls, surprise costs, or data disclosure to third-party services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs users to send prompts, image URLs, audio URLs, and video URLs to external services through infsh, but it does not clearly warn that this data leaves the local environment and may be processed by third parties. For media workflows, inputs may contain sensitive personal, proprietary, or biometric content, so lack of disclosure meaningfully raises privacy and compliance risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill recommends invoking npx skills add ... without pinning an exact package version or immutable source. That allows whatever version is current at execution time to be fetched and run, creating a supply-chain risk if the package is updated maliciously, compromised, or unexpectedly changed.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This unpinned npx skills add ... command executes remotely fetched package code without constraining the version. In a skill that encourages command-line execution, this materially increases exposure to supply-chain compromise and non-reproducible behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Using npx with an unpinned package means end users may execute different code over time, including attacker-controlled updates if the upstream package or distribution channel is compromised. Because the skill is instructional, users are likely to copy-paste the command directly, amplifying risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The command references a package through npx without a fixed version, enabling execution of whatever code the registry serves at that moment. That creates a straightforward supply-chain attack surface and undermines reproducibility and reviewability.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This documentation line exposes users to arbitrary future package changes by instructing them to run an unversioned npx command. If an attacker compromises the package, maintainer account, or dependency chain, users could execute malicious code locally.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

An unpinned npx invocation is a real supply-chain weakness because it delegates trust to mutable upstream state at runtime. In a skill repository, such examples are especially risky because they normalize copy-paste execution of unaudited code.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The final npx skills add ... example also relies on an unpinned package reference, making the executed code mutable and vulnerable to registry/package compromise. This is dangerous because the command is simple, attractive to reuse, and likely to be run with the user's normal local privileges.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The manifest uses Chinese-only display text and description, but does not state that the skill is region-specific or offer any language/locale choice. This can create a language-policy issue if users are expected to interact in a specific language without opt-in or justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.