Video Generation

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:09 AM UTC
• Version: 1.0.3

Overview

This video-generation skill appears legitimate, but needs review because its downloader trusts server-provided URLs without host or size limits while using an API key.

Install only if you are comfortable sending prompts, optional source images, and your TensorsLab API key to the TensorsLab API. Use a virtual environment, avoid passing the API key on the command line, prefer a constrained output directory, and be aware the current downloader lacks URL allowlisting and download size limits.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/tensorslab_video.py:75

Finding

Unrestricted Download of Server-Supplied URLs

Content

View full analysis

Vulnerability Details

File Location: scripts/tensorslab_video.py:75-98, 322-335
Vulnerability Type: Unvalidated remote URL retrieval
Risk Level: Medium

Vulnerable Code

python

def download_video(url: str, output_path: Path) -> bool:
    """Download a video from URL to local path."""
    try:
        response = _SESSION.get(url, timeout=300, stream=True)
        response.raise_for_status()
        total_size = int(response.headers.get('content-length', 0))

        with open(output_path, 'wb') as f:
            if total_size > 0:
                downloaded = 0
                for chunk in response.iter_content(chunk_size=8192):
                    if chunk:
                        f.write(chunk)
                        downloaded += len(chunk)
                        percent = (downloaded / total_size) * 100
                        logger.info(f"\r📥 Downloading: {percent:.1f}%")
            else:
                f.write(response.content)

        logger.info(f"\r✅ Download complete: {output_path}")
        return True
    except Exception as e:
        logger.warning(f"\r⚠️ Failed to download video from {url}: {e}")
        return False

The download function is reached using URLs supplied by the task-status API:

python

urls = task_data.get("url", [])

if not urls:
    logger.warning("⚠️ No videos returned")
    return downloaded_files

for i, url in enumerate(urls):
    url_path = urlparse(url).path
    ext = Path(url_path).suffix
    if not ext or len(ext) > 5:
        ext = ".mp4"
    filename = f"{task_id}_{i}{ext}"
    output_path = output_dir / filename

    logger.info(f"📥 Downloading video {i+1}/{len(urls)}: {output_path}")
    if download_video(url, output_path):
        downloaded_files.append(str(output_path))

Technical Analysis

URLs returned by the remote task-status endpoint are passed direct ...[truncated 2322 chars]

Remediation

View remediation

Remediation Suggestions

1. Permit only https URLs.
2. Maintain an explicit allowlist of documented TensorsLab media/CDN hostnames.
3. Resolve the hostname before connecting and reject loopback, private, link-local, multicast, unspecified, and reserved IPv4 and IPv6 addresses.
4. Disable redirects or validate the scheme, hostname, and resolved address of every redirect destination.
5. Verify that the response has an expected video content type before writing it.
6. Enforce a maximum response size both from Content-Length and while streaming, aborting when the cumulative byte count exceeds the limit.
7. Download to a temporary file and atomically rename it only after all validation succeeds; remove partial files on failure.
8. Use separate connection and read timeouts and cap the number of redirects.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:128

Finding

Unpinned Runtime Dependency Installation Instruction

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:128-132
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Low

Vulnerable Code

markdown

> **依赖**：脚本需要 `requests` 库，首次使用前执行：
> ```bash
> pip install requests
> ```

Technical Analysis

The installation instruction retrieves the latest package release selected by pip without pinning a reviewed version or verifying an artifact hash. It also relies on the user's active package-index and pip configuration. This makes installations non-reproducible and increases exposure to a compromised package index, compromised upstream release, malicious mirror, or unsafe local pip configuration.

The named package is the legitimate and widely used requests package rather than an evident typosquat. Consequently, this is a dependency-hardening deficiency rather than evidence that the project intentionally introduces a malicious package.

Attack Path

1. A user follows the documented pip install requests instruction.
2. The user's pip configuration resolves packages through a compromised or attacker-controlled index or mirror, or an unexpected future release is selected.
3. Pip downloads and installs the selected distribution without project-supplied version or hash verification.
4. Package-controlled installation or runtime code executes with the privileges of the user running pip or the video script.

Impact Assessment

If dependency resolution is compromised, malicious package code can execute with the installing user's privileges. This could expose the API key, prompts, local source images, output files, and other data accessible to that user. It could also modify files within the user's permission boundary.

The finding does not demonstrate that the current official requests package is malicious, and no privilege escalation is inherent unless the user performs installation with elevated privileges ...[truncated 1 chars]

Remediation

View remediation

Remediation Suggestions

1. Declare dependencies in a committed requirements or lock file.
2. Pin requests and its transitive dependencies to reviewed versions.
3. Generate and enforce cryptographic hashes, for example by installing with pip install --require-hashes -r requirements.txt.
4. Document the expected trusted package index and avoid untrusted extra indexes.
5. Recommend installation inside an isolated virtual environment without administrative privileges.
6. Establish a dependency-update process that includes vulnerability scanning and deliberate review before updating pins.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/tensorslab_video.py (reported line 60)May include surrounding context.

python

def get_api_key() -> str:
    """Get API key from environment variable."""
    api_key = os.environ.get("TENSORSLAB_API_KEY")
    if not api_key:
        raise TensorsLabAPIError(

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill explicitly instructs use of environment variables, network API calls, and shell/Python execution, but it does not declare any tool scope or permissions boundary. This can cause the agent runtime to grant or infer broader capabilities than users expect, increasing the risk of unintended command execution, credential exposure, or external data transfer when the skill is invoked.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The markdown includes mandated user-facing messages and examples in Chinese only, such as the authentication guidance and sample requests, without stating that the skill is China-specific or letting the user choose another language. This is a natural-language policy concern because it imposes a locale/language on users by default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documented user message is written only in Chinese, which imposes a specific language on users without opt-in or indication that the skill is region-specific. This is a natural-language locale policy issue because the file does not offer alternative language behavior or justify the constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This Python file contains user-visible log messages in Chinese during task progress, and later also announces completion in Chinese. Because the script does not offer any language or locale selection, it imposes a specific language on users without opt-in, which matches the natural-language policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The final success message shown to users is written in Chinese, while the rest of the CLI largely uses English and there is no documented locale setting. This creates a forced language experience without user choice, which violates the language/locale policy described for SQP-3.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file describes a task deletion operation but provides no warning that invoking it removes tasks, which is a destructive action that could affect user data or workflow state. Under the markdown-specific SQP-2 criteria, destructive behaviors should be accompanied by an explicit warning about their impact.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.