Book Video Generator 2.6.0

• Outcome: Pass
• Latest audit: Jul 20, 2026 · 7:58 AM UTC
• Version: 2.6.0

Overview

This is a coherent book-video generation skill with expected web/API and local media-processing behavior, though users should review its external services and automatic dependency installation.

Install only if you are comfortable with a workflow that contacts search, TTS, and image-generation services and writes generated media locally. Preinstall dependencies yourself where possible, review which API keys and endpoints you set, and avoid pointing SD_WEBUI_URL at untrusted or sensitive internal services.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (15)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

f.write(f"file '{cf}'\n")

    no_subs = os.path.join(tmpdir, "no_subs.mp4")
    subprocess.run(
        [FFMPEG, "-y", "-f", "concat", "-safe", "0", "-i", concat_list,
         "-c", "copy", no_subs],
        capture_output=True, check=True,

• Confidence: 92% confidence
• Finding: The script writes a concat demuxer list and then runs ffmpeg with '-safe 0', disabling path safety checks. Because clip file paths ultimately derive from filesystem state and temporary/output handling, unsafe path handling in concat manifests can enable ffmpeg to consume unexpected files or special paths if an attacker can influence filenames or the working environment.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

f"Alignment=2,MarginV=30"
    )

    subprocess.run(
        [FFMPEG, "-y", "-i", no_subs, "-vf",
         f"subtitles='{ass_escaped}':force_style='{style}'",
         "-c:a", "copy", output_path],

• Confidence: 97% confidence
• Finding: The subtitles filter argument is constructed from dynamic data, including a font name discovered from external command output. FFmpeg filtergraph parsing is fragile, and unescaped special characters in the ASS path or font/style values can break filter parsing or inject unintended filter options, which is especially risky in a skill that processes user-controlled media workflows.

os.system() or os exec-family call

High

• Category: Dangerous Code Execution

Content

import edge_tts
    except ImportError:
        print("正在安装 edge-tts...")
        os.system(f"{sys.executable} -m pip install edge-tts -q")
        import edge_tts

    os.makedirs(os.path.dirname(output_path) or ".", exist_ok=True)

• Confidence: 97% confidence
• Finding: The script executes a shell command at runtime to install a package using os.system, which introduces command execution risk and makes behavior dependent on the host environment and PATH. Even though sys.executable is usually trusted, invoking a shell for dependency installation is unsafe in an agent skill because it performs side effects outside the stated TTS task and can be abused in compromised environments or restricted runners.

os.system() or os exec-family call

High

• Category: Dangerous Code Execution

Content

import volcenginesdkcore
        import volcenginesdkvisualapi
    except ImportError:
        os.system(f"{sys.executable} -m pip install volcenginesdkcore volcenginesdkvisualapi -q")
        import volcenginesdkcore
        import volcenginesdkvisualapi

• Confidence: 97% confidence
• Finding: The script executes a shell command to install Python packages at runtime, which creates a code-execution and supply-chain risk. Even though the package names are hard-coded, this behavior pulls and executes unpinned third-party code during normal operation, expanding trust to the network and package index without verification.

Tainted flow: 'req' from os.environ.get (line 148, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

}).encode()

    req = urllib.request.Request(url, data=data, headers={"Content-Type": "application/json"}, method="POST")
    with urllib.request.urlopen(req) as resp:
        result = json.loads(resp.read())

    image_data = base64.b64decode(result["images"][0])

• Confidence: 84% confidence
• Finding: The script sends prompts to a URL fully controlled by the SD_WEBUI_URL environment variable, with no validation or allowlist. In agent or shared environments, a maliciously set variable could redirect requests to an attacker-controlled host or internal service, causing data exfiltration or SSRF-like access via this script.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill clearly instructs use of network search, external TTS/image services, local file writes, environment variables, and shell commands, yet it declares no explicit permissions or trust boundary warnings. This can cause users or host platforms to run a materially capable skill without informed consent or proper sandboxing, increasing the chance of unintended data exposure or risky command execution.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The workflow hard-codes user_id 10299 in both draft creation and draft saving, which routes created assets and billing attribution through a specific third-party account unrelated to the end user's explicit input. In this skill context, users expect a generic book-video generator, so silent coupling to another creator account can cause unauthorized attribution, privacy leakage of generated content metadata, or unintended revenue/account linkage.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill installs dependencies during execution instead of failing safely or requiring preinstallation, which expands the attack surface and causes unexpected network and system modification behavior. In an agent context, this is risky because a simple audio-generation request can trigger package installation from external sources without clear authorization.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Installing packages at runtime for a media-generation helper is unnecessary from a security perspective and exposes users to supply-chain compromise and unexpected code execution. This is especially risky in automation/agent contexts where the script may run unattended and fetch dependencies without scrutiny.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrases are broad enough to match ordinary requests about making book videos, so the skill may activate in contexts where the user did not intend this specific workflow. That increases the likelihood of unexpected network calls, local configuration changes, or generation actions being taken under an ambiguous invocation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill description does not prominently warn that user-supplied book titles, author names, prompts, and generated content may be transmitted to third-party search, TTS, and image-generation services. In a multi-step media pipeline, this omission raises privacy and compliance risk because users may assume processing is local when it is not.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The installation section includes commands that append to local configuration files and copy content into platform skill directories without clearly warning the user about those modifications. While common for installation docs, silent config and filesystem changes can still lead to accidental enablement of skills or persistence on systems where the user expected a non-invasive setup.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script performs package installation silently through shell execution and without explicit warning or consent. In a skill intended for cross-platform agent use, that undermines user expectations and can trigger unreviewed code download/execution in sensitive environments.

Unvalidated Output Injection

High

• Category: Output Handling

Content

return name

    try:
        result = subprocess.run(
            ["fc-list", ":lang=zh", "family"],
            capture_output=True, text=True, timeout=5,
        )

• Confidence: 95% confidence
• Finding: The output of fc-list is treated as trusted and later used to construct the ffmpeg subtitles filter style string. If a local attacker can influence fontconfig data or font family names, malicious characters in the reported font name could alter ffmpeg filter parsing, causing option injection or unexpected behavior.

Unvalidated Output Injection

High

• Category: Output Handling

Content

f"Alignment=2,MarginV=30"
    )

    subprocess.run(
        [FFMPEG, "-y", "-i", no_subs, "-vf",
         f"subtitles='{ass_escaped}':force_style='{style}'",
         "-c:a", "copy", output_path],

• Confidence: 98% confidence
• Finding: This ffmpeg call embeds dynamic values into the subtitles filtergraph string, including a font name sourced from external command output and a path that is only partially escaped. Because ffmpeg parses this as its own mini-language, malformed or attacker-influenced values can inject additional filter parameters or break parsing, leading to unauthorized file access patterns or command behavior within ffmpeg's processing context.

Static analysis

No suspicious patterns detected.