history-persona-video

• Outcome: Review
• Latest audit: Aug 5, 2026 · 3:33 PM UTC
• Version: 0.1.0

Overview

This skill is a real historical-video workflow, but it bundles and invokes a much broader RunningHub client that can run many unrelated paid media and AI-app operations with local file and API-key access.

Install only if you intend to grant this skill broad RunningHub media-generation authority, not just a historical-video template. Use your own RunningHub API key, expect paid account usage, avoid uploading sensitive local media, and prefer a scoped version that removes unrelated AI-app browsing, voice cloning, translation, 3D, and other unused endpoints.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (22)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def download_file(url: str, output_path: str) -> str:
    Path(output_path).parent.mkdir(parents=True, exist_ok=True)
    cmd = ["curl", "-s", "-S", "-L", "-o", output_path, "--max-time", "300", url]
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        print(f"Download failed: {result.stderr}", file=sys.stderr)
        sys.exit(1)

• Confidence: 91% confidence
• Finding: result = subprocess.run(cmd, capture_output=True, text=True)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

return False
    Path(out_path).parent.mkdir(parents=True, exist_ok=True)
    cmd = ["curl", "-s", "-S", "-L", "-o", out_path, "--max-time", "15", url]
    result = subprocess.run(cmd, capture_output=True, text=True)
    return result.returncode == 0 and Path(out_path).exists() and Path(out_path).stat().st_size > 0

• Confidence: 88% confidence
• Finding: result = subprocess.run(cmd, capture_output=True, text=True)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill clearly instructs use of shell commands, local file reads/writes, and environment-backed API access, yet it declares no permissions. This creates a transparency and governance gap: a reviewer or runtime may underestimate the skill's ability to access local resources or invoke external tools and services. In a skill that performs media generation and compositing, these capabilities are contextually expected, but they still need explicit declaration because they can touch arbitrary files and external accounts.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The documented purpose is a narrowly scoped historical-figure short-video workflow, but the referenced RunningHub integration apparently supports broad generic endpoint discovery, arbitrary task execution, account checks, uploads/downloads, and unrelated media/text capabilities. That mismatch is dangerous because it hides the true operational scope of the skill, increasing the risk of unexpected data exfiltration, misuse of API credits, or execution of workflows far beyond what a user or reviewer consented to. In this context, the broad remote-AI execution surface makes the issue more serious than a simple documentation bug.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The manifest exposes a massive set of capabilities far beyond the declared historical-persona short-video workflow, including unrelated 3D, music, translation, world-generation, editing, and broad media manipulation endpoints. This violates least-privilege and greatly increases the attack surface: if the agent can invoke all listed tools, prompt injection or workflow abuse could pivot the skill into unintended data processing, impersonation, or high-cost content generation.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: Voice cloning is a sensitive impersonation capability and is not clearly necessary for a historical-persona short-video workflow. If exposed through this skill, it could be used to synthesize convincing cloned speech from arbitrary uploaded audio, enabling impersonation, fraud, or deceptive media generation.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Video translation and dubbing are broader than the stated workflow and add unnecessary power to transform third-party media, including speech and subtitles. In a skill already oriented around media generation, this extra capability increases the chance of unauthorized repurposing, misleading localization, or covert content modification.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The script is a broad, universal RunningHub client supporting hundreds of endpoints, while the declared skill is a narrow historical-persona short-video workflow. This scope mismatch increases attack surface and grants operators capabilities unrelated to the stated purpose, making misuse or unintended data handling more likely.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Exposing unrelated capabilities such as 3D generation and generic text-understanding is unnecessary for the advertised short-video production use case. Extra capability breadth materially expands the blast radius if the skill is misused or prompted outside its intended workflow.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The code automatically pulls credentials from environment variables and a user-home config file, which extends privilege and connectivity beyond explicit per-run user input. In a skill context, this can surprise users and enable remote API actions with stored credentials they did not intend to expose to this specific workflow.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: The implementation is a generic RunningHub client capable of listing, inspecting, and executing arbitrary AI applications, which materially exceeds the declared scope of a historical-persona short-video workflow. That mismatch is dangerous because users and higher-level policy may grant trust based on the narrow description while the code actually enables broad remote interactions and execution of third-party workflows.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: These functions let the skill browse and inspect unrelated third-party AI apps, which is not justified by the claimed workflow and exposes users to untrusted remote metadata and outputs. In context, this makes the skill more dangerous because it widens capabilities from a single-purpose media pipeline to a general remote-app discovery and execution client.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The skill hard-codes that all responses must be in Chinese, regardless of the user's language or accessibility needs. This can undermine user comprehension of important safety, billing, or operational instructions, increasing the risk of misuse or uninformed consent when the user does not read Chinese.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The skill declares it should activate whenever the user wants any image generation, which is excessively broad for a reference file and can cause the skill to intercept unrelated image tasks. Over-broad activation increases the chance of unintended routing, policy bypass through forced workflow steps, and user confusion, especially because it mandates a fixed menu and model-selection behavior before proceeding.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The instruction to always rewrite prompts in English without user consent overrides user preference and can violate language-handling expectations or platform policy. In practice, this can alter meaning, reduce transparency, and cause the system to send transformed user input to downstream APIs without approval.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill instructs the agent to rewrite short or vague user prompts before submission without telling the user. In a content-generation workflow, silent prompt transformation can materially change meaning, introduce disallowed or sensitive details, or cause the system to generate content the user did not intend, reducing user control and auditability.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: Mandating English-only prompt translation without user opt-in can alter nuance, historical context, names, tone, or safety-relevant constraints in the original request. In this skill's context of historical-persona video generation, silent translation increases the chance of semantic drift or inaccurate portrayals, which can lead to unintended or policy-violating outputs.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Local media files are uploaded to a third-party endpoint automatically, including when files exceed a size threshold, without an explicit warning at the moment of transfer. This can leak sensitive local content or metadata to an external service contrary to user expectations.

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: The script writes remote results to local storage and even creates parent directories automatically, but does not clearly disclose this side effect up front. While common for media-generation tools, silent filesystem writes can still surprise users and create minor integrity or privacy issues.

Unvalidated Output Injection

High

• Category: Output Handling

Content

def download_file(url: str, output_path: str) -> str:
    Path(output_path).parent.mkdir(parents=True, exist_ok=True)
    cmd = ["curl", "-s", "-S", "-L", "-o", output_path, "--max-time", "300", url]
    result = subprocess.run(cmd, capture_output=True, text=True, encoding="utf-8", errors="replace")
    if result.returncode != 0:
        print(f"Download failed: {result.stderr}", file=sys.stderr)
        sys.exit(1)

• Confidence: 72% confidence
• Finding: subprocess.run(cmd, capture_output

Unvalidated Output Injection

High

• Category: Output Handling

Content

def download_file(url: str, output_path: str) -> str:
    Path(output_path).parent.mkdir(parents=True, exist_ok=True)
    cmd = ["curl", "-s", "-S", "-L", "-o", output_path, "--max-time", "300", url]
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        print(f"Download failed: {result.stderr}", file=sys.stderr)
        sys.exit(1)

• Confidence: 92% confidence
• Finding: subprocess.run(cmd, capture_output

Unvalidated Output Injection

High

• Category: Output Handling

Content

return False
    Path(out_path).parent.mkdir(parents=True, exist_ok=True)
    cmd = ["curl", "-s", "-S", "-L", "-o", out_path, "--max-time", "15", url]
    result = subprocess.run(cmd, capture_output=True, text=True)
    return result.returncode == 0 and Path(out_path).exists() and Path(out_path).stat().st_size > 0

• Confidence: 89% confidence
• Finding: subprocess.run(cmd, capture_output

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.