T08 · Insecure Dependencies
Warning
- Location
scripts/generate_image.py:98- Finding
Automatic Installation of Unpinned Volcengine SDK Packages
- Content
View full analysis
- Remediation
View remediation
Security audit
Book Video Generator 2.6.0
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its book-video purpose, but it automatically installs unpinned Python packages and includes persistent agent setup steps that users should review first.
Install only if you are comfortable with third-party search, image, and TTS services receiving the book title, prompts, and narration text. Prefer installing dependencies manually in an isolated virtual environment with pinned versions, review any ~/.codex/config.toml changes before applying them, avoid reusing the original Coze workflow unless the hard-coded user_id attribution is removed, and set SD_WEBUI_URL only to a trusted local endpoint.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
scripts/generate_audio.py:211- Finding
Automatic Installation of Unpinned edge-tts Package
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/compose_video_moviepy.py:117- Finding
Predictable Shared Temporary Audio Filename in MoviePy Compositor
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (45)
Tainted flow: 'req' from os.environ.get (line 148, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python }).encode() req = urllib.request.Request(url, data=data, headers=headers, method="POST") with urllib.request.urlopen(req) as resp: result = json.loads(resp.read()) image_data = base64.b64decode(result["data"][0]["b64_json"])
Tainted flow: 'req' from os.environ.get (line 148, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python }).encode() req = urllib.request.Request(url, data=data, headers=headers, method="POST") with urllib.request.urlopen(req) as resp: result = json.loads(resp.read()) image_data = base64.b64decode(result["data"][0]["b64_json"])
Tainted flow: 'req' from os.environ.get (line 148, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 93% confidence
- Finding
The local Stable Diffusion endpoint URL is fully controlled by the SD_WEBUI_URL environment variable and is used directly in urllib.request.urlopen. In agent or automation environments, this can be abused to make arbitrary HTTP requests to internal or external services, creating an SSRF-style primitive and potentially sending prompts to an unintended host.
- Content
python }).encode() req = urllib.request.Request(url, data=data, headers={"Content-Type": "application/json"}, method="POST") with urllib.request.urlopen(req) as resp: result = json.loads(resp.read()) image_data = base64.b64decode(result["images"][0])
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
声明描述的是完整的一键式读书视频生成流水线，从书名作者出发自动产出文案、插图、配音、字幕和最终视频；但提供的代码块只是其中的“合成视频”子模块。它依赖外部已准备好的图片、音频、字幕文本及可选 words.json 时间戳输入，不会检索书籍信息，也不会生成书评内容、插图或 TTS 音频。虽然最终确实输出 MP4，并且与“读书视频”场景相关，但其主功能范围明显比声明更窄，属于对能力的重大夸大，因此存在描述与行为不符。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description promises a full pipeline for producing a 3-minute book explanation video from a book title and author, including copywriting, AI illustrations, TTS narration, subtitles, and final MP4 composition. The actual code only implements the illustration portion: it calls image-generation APIs or a local SD WebUI to create images from prompts, either singly or in batch from a storyboard JSON. There is no logic for taking a book title/author, generating reading-summary narration, synthesizing audio, producing subtitles, or assembling a video. While image generation could be a supporting component of the claimed system, this code chunk by itself materially differs in primary purpose and exposed capability from the declared end-to-end book video generator.
- Content
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 93% confidence
- Finding
The skill instructs modification of the agent's configuration file in the home directory using shell redirection to ~/.codex/config.toml and copying files into ~/.codex/skills/. Direct agent config directory access is sensitive because it persists changes outside the skill workspace, can alter agent behavior globally, and may be abused to weaken security controls or plant persistent capabilities.
- Content
bash # 1. 开启 Skills 功能（如未开启） echo '[features]\nsskills = true' >> ~/.codex/config.toml # 2. 复制技能目录 cp -r ~/.workbuddy/skills/book-video-generator ~/.codex/skills/
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 原始扣子工作流文件位于 `references/workflow-original.yaml`，包含 30+ 节点的完整链路：
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 原始扣子工作流文件位于 `references/workflow-original.yaml`，包含 30+ 节点的完整链路：
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
bash # 1. 开启 Skills 功能（config.toml） cat >> ~/.codex/config.toml << 'EOF' [features] skills = true EOF
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
bash # 1. 开启 Skills 功能（config.toml） cat >> ~/.codex/config.toml << 'EOF' [features] skills = true EOF
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The documentation proposes piping content fetched from the network directly into Python execution. This is a classic unsafe pattern because untrusted remote content can be executed as code, enabling arbitrary command execution if the fetched response is manipulated, replaced, or if users adapt the placeholder into a real executable pipeline.
- Content
方案 A — Shell 命令搜索（免安装）：
bash curl -s "https://www.google.com/search?q=书名+作者+简介" | python3 -c "..."方案 B — 安装搜索 MCP 插件：
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The save_draft step explicitly documents and uses a fixed user_id for downstream fee or revenue attribution, stating that new user charges may be partially attributed to that account. That exceeds the stated purpose of video generation and introduces a monetization/account-hijacking risk where user activity benefits an unrelated account.
- Content
os.system() or os exec-family call
High
- Category
- Dangerous Code Execution
- Confidence
- 96% confidence
- Finding
The script executes a shell command to install a package at runtime:
os.system(f"{sys.executable} -m pip install edge-tts -q"). Even though the package name is constant, this introduces code execution and supply-chain risk because the skill can silently fetch and execute unpinned third-party code from the network in the user's environment, which is broader capability than simple TTS generation requires.- Content
python import edge_tts except ImportError: print("正在安装 edge-tts...") os.system(f"{sys.executable} -m pip install edge-tts -q") import edge_tts os.makedirs(os.path.dirname(output_path) or ".", exist_ok=True)
os.system() or os exec-family call
High
- Category
- Dangerous Code Execution
- Confidence
- 96% confidence
- Finding
The script executes a shell command to install Python packages automatically when imports fail. Even though the command string is mostly fixed, invoking pip at runtime performs code retrieval and execution from package indexes without explicit user approval, expanding the script from image generation into arbitrary dependency installation and execution.
- Content
python import volcenginesdkcore import volcenginesdkvisualapi except ImportError: os.system(f"{sys.executable} -m pip install volcenginesdkcore volcenginesdkvisualapi -q") import volcenginesdkcore import volcenginesdkvisualapi
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill describes use of shell commands, file operations, environment variables, and network/API access, but does not declare any explicit tool scope or permissions. In agent platforms, this can cause overbroad execution authority and prevent users or hosts from understanding that the skill may read/write files, call external services, or execute commands.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The display name, description, and workflow are explicitly framed as generating a Chinese three-minute book-summary video, and the documented default voices are Chinese voices. The file does not indicate that users can choose another language or opt into this locale restriction.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The description lists activation phrases such as "生成读书视频", "做读书视频", and "book video" without narrowing context or giving exclusion conditions. These are generic phrases that could match ordinary conversation rather than a clearly scoped skill invocation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The workflow explicitly uses web search, external image-generation APIs, and TTS services, which may transmit user-provided book titles, prompts, captions, or other content to third parties, but the skill does not present a clear privacy/network warning. This creates a data-handling transparency risk and may expose sensitive or copyrighted user content without informed consent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The HTML document explicitly sets
lang="zh-CN", and all visible UI text is presented only in Simplified Chinese. This creates a natural-language locale policy concern because the skill appears to require a specific language without user opt-in or any explanation that the skill is region-specific.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The documentation instructs users to perform networked search and use third-party image APIs, including setting API keys, but it does not warn that book titles, prompts, and other user inputs may be transmitted to external services. In a skill that processes potentially user-supplied content, this creates privacy and credential-handling risk because users may unknowingly send sensitive data to Google, OpenAI, Stability, local web UIs, or other providers.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This markdown file presents all prompts, role instructions, inputs, and outputs only in Chinese, which can amount to a language-policy constraint if users are not given an opt-in or alternative locale. The file does not state that the skill is region-specific or that Chinese is optional, so it appears to force a specific language by default.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description is written as a Chinese-only task description, and downstream prompts consistently instruct the model to generate Chinese reading-video content. Because the file provides no user opt-in, alternate locale option, or documented region-specific justification, this creates a natural-language locale policy concern.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The workflow hard-codes a fixed creator/account identifier (user_id: 10299) into the draft creation step, which is unrelated to the user’s requested task of generating a book-summary video. This creates an implicit cross-account linkage and can route generated assets, ownership, or attribution to a third party without the user’s informed consent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This prompt and the related storyboard prompt are written to produce Chinese-language section titles and storyboard material, reinforcing a fixed-language workflow. Since no alternative locale path or explicit restriction notice is provided in the manifest, the skill embeds a language policy constraint in natural language.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The main LLM prompt defines the assistant as a Chinese reading-video copywriter and requires output in a Chinese JSON content structure for book summaries and metadata. The workflow does not provide any mechanism for the user to request another language or to consent to the locale restriction.
- Content