Security audit

Toonany

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for AI short-drama production, but its API credential handling can leak paid service keys to project-configurable or returned URLs.

Review project.json before use, especially any baseUrl fields, and do not run this skill on projects from untrusted sources. Use limited-scope or disposable API keys where possible, avoid entering confidential manuscripts unless third-party processing is acceptable, and do not print or share full API keys when following setup instructions.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/utils/api_client.py:39
Finding: Bearer API Credentials Can Be Disclosed to Attacker-Controlled Endpoints
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/utils/api_client.py:456
Finding: TTS API Credential Is Embedded in a URL Query String
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Dependency Versions Are Not Reproducibly Pinned or Integrity-Verified
Content: View full analysis
=2.31.0 Pillow>=10.0.0 # Optional but recommended python-dotenv>=1.0.0 ``` The documented installation command is: ```text pip install -r requirements.txt ``` ### Technical Analysis The requirements use open-ended minimum-version constraints. A future package version can therefore be selected without having been reviewed with this Skill. The project also provides no lock file or package hashes to verify that installed artifacts match audited releases. This does not establish that any listed dependency is currently malicious. It creates a supply-chain exposure in which installation results can change over time and may include a compromised or incompatible future release. ### Attack Path 1. A dependency maintainer account, release process, or package-distribution channel is compromised. 2. A malicious release is published under one of the legitimate dependency names with a version satisfying the open-ended constraint. 3. A user follows the documented `pip install -r requirements.txt` procedure. 4. The resolver selects the malicious release because it satisfies the `>=` requirement. 5. Malicious package installation or runtime code executes with the privileges of the user performing the installation or running the Skill. ### Impact Assessment Impact depends on the privileges under which installation or execution occurs. A compromised dependency could read files and environment variables available to the process, including configured API keys; modify project output; make network requests; or execute code with the installing user's permissions. No evidence was found that the current named packages are malicious, and the requirements do not use obvious typosquatting names or untrusted package indexes. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (89)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description focuses on creative AI content generation for short dramas, script writing, storyboarding, and video workflow support. The actual code does not perform any AI generation, story conversion, script creation, storyboard generation, or video production logic. Instead, it implements a project export tool that copies files from a directory and writes a manifest summarizing exported assets. This is a materially different primary purpose and introduces undeclared filesystem export capabilities unrelated to the stated triggers and description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared description centers on creating AI short dramas from written stories: script writing, story line generation, storyboard generation, and end-to-end video content workflows. The supplied code does none of that. Its concrete behavior is narrowly focused on generating visual asset reference images (character four-view sheets, scene images, prop images) from existing asset metadata in JSON, optionally anchored by a style reference image. It also writes back file paths and seeds into data.json and project.json. While asset generation could be a supporting part of a broader video/drama pipeline, this code chunk’s primary purpose is materially different from the declared purpose and omits the claimed core capabilities such as story conversion, screenplay generation, and storyboard/drama creation. Therefore this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The code chunk does not create short dramas from novels, generate outlines, produce storyboards, or perform novel-to-script conversion. Its primary function is downstream audio production: turning an already-written script into voiced audio and subtitles. While this could be part of a broader video production pipeline, the declared description emphasizes creative generation workflows (漫剧创作, 小说转剧本, 分镜生成, 故事线生成) rather than TTS synthesis and subtitle generation. Because the actual code’s main behavior is materially different and introduces undeclared capabilities involving external TTS API use and media/subtitle file generation, this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The code chunk does not implement drama creation, novel-to-script conversion, storyboard generation, story-line generation, or video production logic. Its primary function is infrastructure/configuration management: loading project settings, parsing model definitions, checking missing API credentials, and producing user guidance for setup. While such configuration support could be part of a larger video-generation tool, this specific code’s behavior is materially different from the declared skill purpose and omits the claimed creative/content-generation functionality. Therefore, the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a creative generation skill for turning stories into short dramas and producing scripts, storyboards, and video workflows. The supplied code does none of that. Instead, it reads project files from disk, loads asset names from assets/data.json and style data from project.json, scans markdown files, extracts names via regex heuristics, and reports consistency issues. This is a materially different primary purpose: project validation/consistency checking rather than AI content creation. While such checking might support a drama-production project, it is not merely an implementation detail of the declared functionality; it is the actual core behavior shown here.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description claims the skill is for AI-generated short drama creation and related creative/video production tasks. However, the supplied code chunk does not perform any content generation, story processing, script writing, storyboard creation, or video workflow logic. It only sets up logging infrastructure. While logging can be a supporting utility inside a larger drama-creation project, this specific code chunk's actual behavior is materially different from the declared primary purpose. Therefore, based on the supplied code, the description does not accurately represent what this code chunk does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description frames the skill as a creative content generation tool for transforming written stories into short dramas and related video assets. However, the supplied code chunk only validates project consistency across files and checks for stale dependencies. Its primary purpose is QA/validation of project artifacts, not content generation or drama production. This is a clear description-behavior mismatch because the actual functionality is materially different and unrelated to the declared creative workflow.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The code does not generate dramas, scripts, storyboards, or videos. Instead, it validates an existing project structure: it checks for project.json, required model configuration fields, required directories, storyline.md sections, outline files, and asset files, then reports errors/warnings. While the validated artifacts are related to drama/video projects, the primary behavior is project validation/QA. That is materially different from the declared purpose of creative AI content generation and workflow activation for story-to-video production tasks.
Content: No source excerpt is available for this finding.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · TUTORIAL.md (reported line 44)May include surrounding context.
md
brew install ffmpeg # Ubuntu/Debian sudo apt update && sudo apt install ffmpeg # Windows (使用 chocolatey) choco install ffmpeg

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill documentation is written entirely in Chinese and presents the assistant as a general-purpose tool for "anyone" without offering an alternative language option or stating that it is intended only for Chinese-speaking users. This creates a natural-language locale policy concern because it implicitly fixes the user experience to one language without opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill instructs users to paste or upload story content and states that API keys will be checked automatically, but it does not disclose what external providers may receive that content or how credentials are handled. In a content-generation pipeline that uses multiple third-party text, image, video, and audio services, this can lead users to unintentionally transmit sensitive manuscripts, personal data, or secrets to remote APIs.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises capabilities that imply environment access, file reads/writes, network use, and shell execution, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an overbroad trust boundary where an operator cannot easily determine or constrain what the skill may do before invocation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill clearly relies on third-party AI providers for text, image, video, and audio generation, yet the description does not warn users that story content and generated assets may be transmitted to external services. This creates a privacy and data-governance risk, especially if users process copyrighted, confidential, or sensitive material under the assumption the workflow is local.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The invocation examples and trigger phrases are specified entirely in Chinese, and the rest of the skill documentation is predominantly Chinese-language, but there is no statement that the skill is Chinese-only or that users may choose another language. This creates a locale/language policy concern because the skill appears to impose a specific language without opt-in.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · TUTORIAL.md (reported line 44)May include surrounding context.
md
brew install ffmpeg # Ubuntu/Debian sudo apt update && sudo apt install ffmpeg # Windows (使用 chocolatey) choco install ffmpeg

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/post_process.py (reported line 223)May include surrounding context.
python
brew install ffmpeg # Ubuntu/Debian sudo apt update && sudo apt install ffmpeg # Windows (使用 chocolatey) choco install ffmpeg

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The tutorial instructs users to paste or upload full novel content and then process it through multiple external AI, TTS, and video providers, but it does not clearly disclose that the content and derived assets may be transmitted to third-party services. This creates a real privacy and confidentiality risk, especially if users submit copyrighted, unpublished, or sensitive material under the assumption it stays local.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The configuration hard-codes Chinese values for project type and art style, which imposes a specific language/locale choice by default. There is no indication that the user can opt into or change the locale, and no documented justification that this is a region-specific tool.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file is a markdown prompt and all operative instructions are written in Chinese, beginning with a Chinese-only checklist header and directive. Under the policy criteria, this constitutes a language/locale constraint without any visible user opt-in or documented region-specific justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file is entirely written as a Chinese-only instruction set and directs the model with fixed behavior, without any indication that language choice is optional or tied to a region-specific requirement. This can violate language/locale policy when a skill imposes a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The template explicitly requires '详细的英文提示词' (detailed English prompts), which imposes a specific language choice in the skill's output. The file does not offer the user a language option or explain why English is required, so this is a natural-language policy violation under the locale/language rule.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file presents all operative instructions in Chinese and mandates a single response mode without offering any language or locale choice. Under the policy, forcing a specific language is a natural-language policy violation unless the constraint is explicitly justified or optional.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file states the skill converts Chinese storyboard descriptions and specifies an output format mixing English tags with Chinese subject content, effectively imposing a Chinese-language workflow. Because no user opt-in, alternative language support, or justification for this locale constraint is provided, this is a natural-language policy issue under the language/locale rule.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The onboarding prompt tells users to run echo $DEEPSEEK_API_KEY and echo $VOLC_API_KEY, which prints secret credentials directly to the terminal and can expose them through screen sharing, terminal logging, shell history capture, or copied output. In a setup/onboarding context, users are especially likely to follow these instructions verbatim, so the guidance normalizes unsafe handling of secrets.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file title and core role instructions are entirely specified in Chinese, and the skill mandates direct output in that format. This imposes a specific language on users without any opt-in or indication that the skill is intentionally limited to a Chinese-only regional context.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/generate_assets.py:338

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/generate_audio.py:264

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/generate_storyboard_images.py:309

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/generate_video.py:279