BytePlus MediaKit Video Highlights

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:17 AM UTC
• Version: 1.0.0

Overview

The skill matches its video-highlights purpose, but its bundled script can send API credentials and task data to an arbitrary configured endpoint and can print custom secret headers during diagnostics.

Install only if you trust the local environment and configuration used with this skill. Keep the endpoint pinned to the documented BytePlus HTTPS host unless you intentionally use an approved internal environment, avoid storing secret-bearing custom headers, and treat doctor output as potentially sensitive when custom headers are configured.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/video_highlights_llm.py:135

Finding

Bearer Credential and Task Data Can Be Sent to an Unrestricted Endpoint

Content

View full analysis

Vulnerability Details

File Location: scripts/video_highlights_llm.py, lines 135–138
Vulnerability Type: Unrestricted destination for authenticated network requests
Risk Level: High

python

endpoint = (args.endpoint or _env_value("BYTEPLUS_MEDIAKIT_ENDPOINT", "MEDIAKIT_ENDPOINT") or _first_config_value(config, "endpoint", "base_url", "baseUrl") or DEFAULT_ENDPOINT).rstrip("/")
data = None if payload is None else json.dumps(payload, ensure_ascii=False).encode("utf-8")
request = urllib.request.Request(f"{endpoint}{path}", data=data, headers=_headers(args), method=method)
try:
    with urllib.request.urlopen(request, timeout=args.timeout) as response:
        body = response.read().decode("utf-8")

Technical Analysis

The request destination can be supplied through --endpoint, the BYTEPLUS_MEDIAKIT_ENDPOINT or legacy MEDIAKIT_ENDPOINT environment variable, or the configured endpoint, base_url, or baseUrl property. The value is used without validating its scheme or hostname.

Every submit or query request is created with _headers(args), which includes the MediaKit API key as an Authorization: Bearer ... header. Consequently, an arbitrary configured endpoint receives both the bearer credential and the request content. The code does not require TLS, restrict destinations to the documented BytePlus service, or prevent a production credential from being attached after the destination changes.

Supporting internal environments may require endpoint configuration, but unrestricted destination selection exceeds the minimum privilege required for the declared default functionality.

Attack Path

1. An attacker influences a command, environment, or configuration source used by the Skill.
2. The attacker sets --endpoint, BYTEPLUS_MEDIAKIT_ENDPOINT, MEDIAKIT_ENDPOINT, or a configuration endpoint to a server under their control, potentially using plaintext HTTP.
3. The user or Agent invoke ...[truncated 1017 chars]

Remediation

View remediation

Remediation Suggestions

1. Require https:// for every endpoint and reject plaintext HTTP.
2. Allowlist the documented production hostname by default:
   • mediakit.ap-southeast-1.bytepluses.com
3. Maintain a separate explicit allowlist for approved internal MediaKit environments.
4. Require an explicit high-friction opt-in for non-allowlisted development endpoints.
5. Do not attach a production API key when the endpoint hostname differs from its approved destination.
6. Parse endpoints with urllib.parse.urlsplit and reject:
   • Unsupported schemes.
   • Embedded user information.
   • Unexpected ports.
   • Missing or malformed hostnames.
   • Ambiguous hostname encodings.
7. Consider binding credentials to named endpoint profiles instead of accepting arbitrary endpoint strings.
8. Display the validated destination during preflight without printing credentials, allowing users to detect unexpected configuration before submission.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/video_highlights_llm.py:310

Finding

Doctor Command Can Print Secret Custom Header Values

Content

View full analysis

Vulnerability Details

File Location: scripts/video_highlights_llm.py, lines 310–319
Vulnerability Type: Insufficient redaction of sensitive configuration
Risk Level: Medium

python

headers = _headers(probe_args)
endpoint = args.endpoint or _env_value("BYTEPLUS_MEDIAKIT_ENDPOINT", "MEDIAKIT_ENDPOINT") or _first_config_value(config, "endpoint", "base_url", "baseUrl") or DEFAULT_ENDPOINT
api_key_present = bool(_optional_api_key(args))
result = {
    "ok": api_key_present,
    "api_key": {
        "present": api_key_present,
        "source": _api_key_source(args, config),
    },
    "endpoint": endpoint,
    "environment": "prod",
    "headers": {key: value for key, value in headers.items() if key != "Authorization"},
}

Technical Analysis

The doctor command is documented as checking readiness without printing secrets, but its redaction removes only a header whose name exactly matches the case-sensitive string Authorization.

Custom headers are accepted through --header, BYTEPLUS_MEDIAKIT_HEADERS, or MEDIAKIT_HEADERS and can override existing headers. HTTP header names are case-insensitive, so a credential supplied as authorization, AUTHORIZATION, or another casing is still semantically an authorization header but is printed by this code. Other routinely sensitive headers—such as Cookie, Proxy-Authorization, X-API-Key, and custom token headers—are also printed without masking.

The output is written to standard output as JSON. In Agent, CI, support, or diagnostic workflows, standard output may be retained in transcripts or logs.

Attack Path

1. A user or environment configures a sensitive custom header through --header, BYTEPLUS_MEDIAKIT_HEADERS, or MEDIAKIT_HEADERS.
2. The header uses a non-exact authorization casing or another secret-bearing name, such as X-API-Key or Cookie.
3. The documented doctor preflight command is executed.
4. `_headers() ...[truncated 890 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not print custom header values from the doctor command. Report only header names and whether they are present.
2. Normalize header names to lowercase before applying redaction.
3. Always redact standard sensitive headers, including:
   • authorization
   • proxy-authorization
   • cookie
   • set-cookie
   • x-api-key
4. Mask custom headers whose names contain terms such as auth, token, secret, key, credential, or cookie.
5. Use a single centralized sanitization function for all diagnostic and error output.
6. Add tests covering mixed-case header names and custom secret-bearing headers.
7. If values must be distinguished during troubleshooting, print a non-reversible fingerprint or a short masked form rather than the original value.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill instructs use of environment variables, file-based config, and networked API submission/query, but it does not declare an explicit tool scope such as allowed tools or permissions. This creates an authorization gap where an agent may invoke broader capabilities than reviewers or policy expect, increasing the chance of unintended file, env, or network access.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: byteplus-mediakit-video-highlights
description: Create and query BytePlus/MediaKit video highlight editing tasks with the video-highlights-llm tool, focused on preset-based football highlight reels. Use when the user asks to generate, submit, or query highlight edits from one or more HTTP/HTTPS video URLs, optionally with preset (football), scoring_prompt, analysis_prompt, callbacks, or one or more target durations.
---

# BytePlus MediaKit Video Highlights

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md

- `scoring_prompt`: optional scoring override. If supplied with `preset`, it overrides the preset's scoring scene.
   - `analysis_prompt`: optional analysis enhancement. It does not replace `preset` or `scoring_prompt`.
   - Optional: `callback_url`, `callback_args`, `client_token`.
2. Run `scripts/video_highlights_llm.py doctor` before the first real submit/query in a session, or whenever credentials/environment are uncertain. Do not ask the user to paste an API key into chat.
3. If no usable video material is present, ask the user for real video material before submitting. Accept one or more HTTP/HTTPS video URLs.
4. Submit the task with `scripts/video_highlights_llm.py submit`.
5. Capture the returned `task_id`, usually shaped like `amk-tool-video-highlights-llm-...`.

Static analysis

No suspicious patterns detected.