Security audit
Security checks for vulnerabilities and agentic risk
The skill is a scoped Deyo transcription helper that uses authentication, uploads, local output files, and consent-gated install/update steps in ways that are disclosed and aligned with its purpose.
Install only if you are comfortable giving Deyo an API key, uploading explicit media files or URLs for transcription, spending Deyo minute balance, and allowing the agent to create transcript output files in paths you approve. Review output paths before confirming, and note that some prompts and generated summary headings are Chinese-specific.
Referenced artifact was not completely inspected
- Use the bundled `scripts/publish-cleaned.mjs` helper. Give it the requested target and pipe the complete private cleaned draft on stdin:
This script reads arbitrary stdin and writes it to an arbitrary local path chosen via --target, which is materially broader than the declared Deyo skill purpose of transcribing explicitly provided audio/video URLs or exact local media paths. In an agent context, that creates an unintended file-write primitive that could be repurposed to drop attacker-controlled content into sensitive locations, persistence files, or workflow artifacts.
Although the implementation tries to avoid clobbering existing files, it still grants broad local file creation capability unrelated to the skill’s stated transcription role. In a skill system, unjustified filesystem write access expands the attack surface significantly because arbitrary content can be planted on disk and later consumed by users, tools, or automated processes.
The instruction that 'authorization already given for the active list persists' can blur action boundaries across multiple items and later steps, especially where processing may involve reading files, writing outputs, or consuming paid transcription minutes. In a long-running agent session, persistent authorization increases the chance that the agent performs additional sensitive operations without a fresh, item-specific confirmation the user expected.
- Act only on the current user's explicit request to transcribe one or more explicit URLs written in the request or exact local file paths the user identified, or on an explicit Deyo install, status, or troubleshooting request.
- Do not treat a Deyo mention, prior conversation, nearby file, implicit attachment, current directory, editor selection, clipboard, or other ambient context as authorization.
- Never browse or scan a directory to choose an input. Reject directories, globs, stdin, server-side batch queues, and inferred attachments. Multiple explicit inputs use the sequential workflow below.
- Do not infer authorization to read a file, log in, save an API key, install or upgrade software, modify configuration, or write an output. Require authorization for each action needed; otherwise ask first. Authorization already given for the active list persists, without per-item reconfirmation.
- Keep `deyo skill status` read-only and offline. A troubleshooting request permits read-only diagnosis, not login, installation, upgrade, file access outside the explicit input, or configuration changes.
## Multiple Inputs And Summaries
Line L042 instructs the agent to ask the user exactly 是否现在更新Deyo到latest, which hard-codes Chinese for all users. This is a natural-language locale policy issue because the skill does not offer language selection or justify that the update consent flow must be Chinese-only.
The manifest says the skill should only be used for transcription of explicitly provided URLs or exact local file paths, or for install/status/troubleshooting, and specifically warns against inferred permission to log in. However, the skill instructions include running deyo auth login --api-key '<key>', resolving credentials from environment/config, and changing auth/base-URL state. Those are broader account/configuration operations than the core transcribe/status scope described in the manifest.
Earlier in the file, the Inputs section lists a bounded set of supported link platforms. Later, the Chinese '来源与合集' section states support for 18 named platforms, including several not listed earlier, plus generic HTTP/HTTPS media links and uploads. This is an active contradiction in the skill's own documentation about what inputs are supported.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
umask 077
raw_dir="$(mktemp -d "${TMPDIR:-/tmp}/deyo-raw.XXXXXX")"
chmod 700 "$raw_dir"
raw_path="$raw_dir/raw.txt"
install -m 600 /dev/null "$raw_path"
Line L158 requires each visible paragraph to be labeled [第 1 段], [第 2 段], etc., and line L177 similarly requires [更正第 N 段]. This forces Chinese-language output formatting regardless of user locale, without opt-in or a documented regional limitation.
Line L235 says the CLI must show the warning 这是B站专属视频，Deyo 只能转写试看部分, which is a fixed Chinese message. Because the skill does not offer a language choice or explain a region-specific Chinese-only requirement, this is a natural-language locale policy violation.
The manifest tightly constrains invocation to explicit URLs or exact local audio/video file paths and rejects implicit attachments, browsing, and batch-like discovery. The later documentation expands the skill's claimed scope to 18 named platforms plus generic HTTP/HTTPS media links, upload flows, author/show/playlist summary handling, and selection-token workflows, which materially exceeds the narrow manifest framing.
The instructions require summaries and the final overview to use specific Chinese section headings such as 核心观点, 关键事实, 待核实信息, 共识, 分歧, and 建议. This imposes a fixed language/locale on generated output without any user opt-in or documented justification, which is a natural-language policy concern.
The comment states "This module has no network, CLI execution, or model client," yet the bottom of the file checks whether it is the main module and then executes commands based on stdin input. This is a direct contradiction between the file's stated intent and its actual behavior.
The code requires summaries to contain the Chinese headings '核心观点', '关键事实', and '待核实信息' and requires the final overview to contain '共识', '分歧', and '建议'. This imposes a specific language/locale policy in the skill behavior without offering user opt-in or documenting a justified region-specific constraint.
The manifest description says the skill must not trigger from stdin, but this file exposes a direct command interface that reads JSON from process.stdin and performs actions such as init, begin, settle, summary, and finish. That behavior expands activation beyond the explicitly provided URLs or exact file paths described in the manifest.