video-workflow-builder

• Outcome: Review
• Latest audit: Aug 7, 2026 · 12:32 PM UTC
• Version: 0.1.0

Overview

This skill is not proven malicious, but it bundles broad file-writing, external API, persistent storage, and social-platform scraping capabilities that need careful review before installation.

Install only if you are comfortable with a skill that creates other installable skills, runs bundled Python scripts, stores content history under your home directory, and uses external search/image/LLM gateways. Use dedicated limited API keys, avoid storing personal social-platform sessions unless you explicitly need the Douyin tooling, inspect generated skills before enabling them, and delete or disable the scraping/transcription scripts if you only want the basic workflow builder.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (28)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not server_script.exists():
            sys.exit(f"[下载] 找不到 {server_script}（TIKTOK_DOWNLOADER_DIR 指向的目录里应有 headless_server.py，见 docs/）")
        log("下载", "启动下载服务...")
        self.proc = subprocess.Popen(
            [sys.executable, str(server_script)],
            cwd=str(DOWNLOADER),
            stdout=subprocess.DEVNULL,

• Confidence: 89% confidence
• Finding: self.proc = subprocess.Popen( [sys.executable, str(server_script)], cwd=str(DOWNLOADER), stdout=subprocess.DEVNULL, stderr=subprocess.STDOUT,

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill exercises sensitive capabilities including shell execution, filesystem writes, network access, and environment-variable usage, yet does not declare permissions or clearly bound them. In a generator skill that writes installable artifacts and invokes scripts, this weakens user visibility and review, making unexpected side effects harder to detect before execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose is a lightweight three-question workflow builder, but the instructions authorize materially broader behavior: web scraping, downloading media, audio extraction, cloud uploads, ASR transcription, cover-image generation, persistent database maintenance, hotlist ingestion, and validation tooling. This mismatch is dangerous because users may consent to a narrow planning assistant while the skill actually performs high-risk data collection, external transfer, and persistent local modifications.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to create and populate a real .env file with API keys, moving from workflow generation into direct secret handling. This increases the chance of accidental credential exposure, persistence of secrets in unintended locations, or leakage through generated artifacts, logs, or later tooling that reads the skill directory.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: Mandating a persistent content database and metrics-update tooling broadens the skill from one-time workflow generation into ongoing storage and tracking of user content and performance data. That persistence increases privacy and data-retention risk, especially when it is created by default rather than as an explicit optional feature with retention limits.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This exemplar materially exceeds the stated purpose of a generic video-workflow builder by embedding a specialized stock-analysis and finance-content skill. That expansion is dangerous because it can cause downstream generated skills to perform regulated, high-stakes financial analysis and advice under the guise of a generic workflow tool, increasing the chance of harmful or noncompliant outputs.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The file explicitly instructs the agent to provide buy/sell/hold recommendations and key price levels, which crosses from content assistance into actionable investment advice. In context, this is especially dangerous because the parent skill is a workflow builder, so these instructions are not necessary for the claimed function and could propagate unsafe financial-advice behaviors to generated skills.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The exemplar directs the agent to invoke local Python scripts via shell and to rely on environment-backed image-generation tooling, introducing execution and capability expansion beyond what a workflow-builder exemplar should require. While not inherently malicious, these instructions normalize local code execution and secret-dependent operations from reference content, which increases attack surface if similar patterns are copied into generated skills.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The documented behavior materially expands the skill from a workflow generator into a capability that performs account scraping, competitor analysis, transcript extraction, and ongoing monitoring. That scope expansion increases privacy, compliance, and abuse risk because an agent invoked for benign content-planning could be used to collect large amounts of third-party platform data and derive protected content artifacts such as spoken scripts.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The documentation instructs use of persistent sessions, valid Douyin cookies, third-party downloader tooling, and external cloud services with credentials, which creates multiple sensitive-asset handling risks. If an agent or operator misuses these instructions, it could enable credential exposure, unauthorized access persistence, scraping under a personal account, and unbounded paid API usage, all of which go well beyond the minimal needs of a workflow-builder skill.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The template expands from a workflow-generation skill into a persistent content archiving and performance-tracking system. That creates additional data collection and retention behavior not clearly required for the stated purpose, increasing privacy and scope-creep risk if users do not explicitly expect long-term local storage of drafts, metadata, and publication metrics.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: This section adds a persistent analytics/database capability beyond the core promise of generating a custom video workflow skill. Even if stored locally, accumulating content history, IDs, and engagement metrics broadens the attack surface and can expose sensitive business or account strategy data if the host environment is shared or later compromised.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The template injects mandatory sovereign-territorial and political compliance rules into a skill whose stated purpose is building video-creation workflows from minimal user inputs. This expands the skill into policy-driven content adjudication unrelated to the declared function, creating hidden behavioral constraints and a risk of steering outputs on sensitive political topics without explicit user awareness or manifest disclosure.

Description-Behavior Mismatch

Low

• Confidence: 80% confidence
• Finding: The file defines a full pass/fail final-script review and archival gate, which materially exceeds a skill advertised as generating a customizable workflow from three inputs. This hidden expansion of authority can cause the skill to perform undisclosed moderation or approval functions, reducing predictability and violating least-privilege expectations for agent skills.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: This template directs the agent to access a local skill-specific database under the user's home directory and use its contents to influence outputs. That expands the skill from the declared 'three questions + web research' scope into local data access, creating a data-flow mismatch that can expose or over-rely on local content without explicit user consent or manifest disclosure.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script reads Douyin cookie material from another tool's local settings.json and uses it to authenticate outbound requests. Accessing and reusing session credentials is sensitive behavior, especially because it is unrelated to the advertised account-workflow-building function and could enable account misuse or unauthorized scraping if the local downloader store is compromised.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Launching an external headless downloader service and invoking ffmpeg are capabilities that materially exceed the stated purpose of generating a reusable creator workflow. This mismatch makes the skill more dangerous because users may authorize or run it expecting planning assistance, not local code execution and media-processing infrastructure.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements a full Douyin download, upload, transcription, and LLM-processing pipeline rather than the manifest-described workflow-builder behavior. That scope mismatch is dangerous because it conceals significant data handling, credential use, and code-execution capabilities behind a benign-seeming skill description, undermining informed consent and review.

Description-Behavior Mismatch

High

• Confidence: 91% confidence
• Finding: The file implements a full Douyin scraper that logs in, saves session state, enumerates all videos, and harvests comments, which is materially different from the declared skill purpose of generating a creator workflow from a few inputs. This capability mismatch is dangerous because it introduces covert data-collection behavior, expands the attack surface, and may capture sensitive account/session data without clear user necessity or informed consent.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: Collecting complete account metrics, all video links, per-video engagement data, and top comments is excessive relative to a workflow-builder that supposedly needs only platform, niche, and persona. In this context, the overbroad collection is risky because it enables large-scale profiling and retention of third-party content and comments, including persistent session data, beyond what is needed for the advertised task.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The --full mode allows the tool to fetch arbitrary user-supplied URLs directly with urllib, which expands the skill from search into unrestricted remote content retrieval. In an agent context, this can be abused for server-side request forgery against internal services or metadata endpoints if the agent runs in a networked environment with access beyond normal user reach.

Description-Behavior Mismatch

Medium

• Confidence: 82% confidence
• Finding: The guide says the generator only needs three answers and largely frames the tool as a workflow generator, but later discloses automatic long-term persistence of produced content in a separate database. That mismatch creates a transparency and consent problem: users may not reasonably expect ongoing data retention, which can expose sensitive creative history, business plans, or account strategy beyond the narrowly stated purpose.

Context-Inappropriate Capability

Medium

• Confidence: 78% confidence
• Finding: Automatically creating a long-term content database is broader than the stated purpose of generating a custom workflow skill, and the documentation does not justify the necessity or scope of that storage. Unnecessary retention increases attack surface and privacy risk because historical content decisions, topic planning, and production outputs may accumulate without clear user awareness or minimization.

Session Persistence

Medium

• Category: Rogue Agent

Content

- **联网搜索（统一走网关，别用自带 WebSearch）**：本技能的联网搜索**一律通过内置的 `scripts/web_search.py`（qianfan web search 网关）**，**不要**直接用 Claude Code 自带的 `WebSearch` 或 Codex 自带的联网搜索工具。这样搜索源可控、结果结构统一、跨 agent 环境行为一致。调用方式：`python3 "$SKILL_DIR/scripts/web_search.py" "搜索词" [--top N] [--json]`（密钥从技能目录 `.env` 的 `QIANFAN_WEBSEARCH_API_KEY` 读取，已随技能配好）。若网关报错/无密钥，如实告知用户无法获取实时数据，退回内部知识作研究依据，不要用记忆里的旧数据冒充实时情报，也不要偷偷改用自带 WebSearch。
- **抓取网页正文**：优先看 `web_search.py` 每条结果自带的 `content` 字段（网关已摘出约前 1000 字，判断相关性/快速扫风向足够）。需要读**完整全文**（网关 content 只有全文约两成、且从中间截断）时，用 `python3 "$SKILL_DIR/scripts/web_search.py" <url> --full [--max-chars N]` 本机直抓提纯——**不要用 Claude Code/Codex 自带的 WebFetch**：它跑在云端，对国内站（163/百家号/东方财富等）会系统性报"无法确认域名安全"而失败，本机抓取则没有这个问题。
- **写文件**：Claude Code 用 `Write` 工具；Codex 直接用其文件写入能力（或 `apply_patch`）。凡说"用 Write 工具生成某文件"，即指"用当前环境的文件写入能力落地该文件"。生成产物 skill 时涉及的每一个文件（SKILL.md、各模块文档、脚本、配置）都要真实落地到磁盘，不能只在对话里描述。
- **跑脚本**：两个环境都通过 shell 执行 `python3`。脚本路径见下方「脚本路径」——一律用技能目录的绝对路径，不要假设当前工作目录就是技能目录。

### 脚本路径

• Confidence: 90% confidence
• Finding: Write 工具生成某文件"，即指"用当前环境的文件写入能力落地该文件"。生成产物 skill 时涉及的每一个文件（SKILL.md、各模块文档、脚本、配置）都要真实落地到磁盘，不能只在对话里描述。 - **跑脚本**：两个环境都通过 shell 执行 `python3`。脚本路径见下方「脚本路径」——一律用技能目录的绝对路径，不要假设当前工作目录就是技能目录。 ### 脚本路径 本技能自身的

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 安装: pip install -r scripts/requirements-douyin.txt
#   playwright 还需: playwright install chromium
#   douyin_transcript 还需系统安装 ffmpeg，以及外部 TikTokDownloader（GPL，单独 clone）
playwright
httpx[socks]
aliyun-python-sdk-core==2.16.0
oss2

• Confidence: 89% confidence
• Finding: playwright

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_generate_cover.py:9