Video Creator

• Outcome: Review
• Latest audit: Jul 21, 2026 · 12:38 PM UTC
• Version: 1.0.1

Overview

This video skill appears purpose-built, but it needs review because it can upload voice and portrait media, persist voice/API data, install packages at runtime, and delete a user-chosen output directory.

Review this before installing, especially on shared or sensitive machines. Only use it with voice samples and portraits you are authorized to process, expect uploads to platform.delilegal.com/OSS for remote AI features, preinstall dependencies through a controlled setup, keep --output inside a dedicated disposable folder, and avoid storing real API keys in plaintext config unless that is acceptable for your environment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (27)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

import httpx  # noqa: F811
        return httpx
    except ImportError:
        subprocess.run(
            [sys.executable, "-m", "pip", "install", "httpx", "certifi", "-q"],
            check=True,
        )

• Confidence: 92% confidence
• Finding: The code automatically invokes pip at runtime via a subprocess when httpx is missing. Executing package installation during normal skill operation expands the attack surface, can pull code from external package indexes without explicit approval, and creates a code-execution path controlled by the runtime environment and dependency resolution.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

except ImportError:
        log("httpx 或 certifi 未安装，正在安装...", "WARN")
        import subprocess
        subprocess.run([sys.executable, "-m", "pip", "install", "httpx", "certifi", "-q"], check=True)
        import httpx
        import certifi

• Confidence: 95% confidence
• Finding: The script installs Python packages at runtime via pip when imports fail. This creates a supply-chain and execution risk because code is fetched and executed dynamically during normal operation, and it can also modify the host environment without prior approval. In a skill context, automatic dependency installation is more dangerous because the agent may run in shared or sensitive environments.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

import certifi
        import hashlib
    except ImportError:
        subprocess.run([sys.executable, "-m", "pip", "install", "requests", "certifi", "-q"], check=True)
        import requests as _requests
        import certifi
        import hashlib

• Confidence: 96% confidence
• Finding: The script automatically installs Python packages at runtime with pip when imports fail. In an agent/skill context this is dangerous because execution can fetch and execute unpinned third-party code from external package repositories, expanding the trust boundary and enabling supply-chain compromise or environment tampering.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

import edge_tts
    except ImportError:
        log("edge-tts 未安装，正在安装...", "WARN")
        subprocess.run([sys.executable, "-m", "pip", "install", "edge-tts", "-q"], check=True)
        import edge_tts

    if gender == "male" and lang in EDGE_TTS_MALE_VOICES:

• Confidence: 96% confidence
• Finding: This code auto-installs edge-tts at runtime via pip. A skill that self-modifies its environment by downloading executable dependencies during execution can be abused through package supply-chain attacks and breaks the expectation that the skill only processes user media.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

from dashscope_api import generate_image as api_gen_image
        import requests as _reqs
    except ImportError:
        subprocess.run([sys.executable, "-m", "pip", "install", "requests", "-q"], check=True)
        import requests as _reqs
        sys.path.insert(0, str(Path(__file__).parent))
        from dashscope_api import generate_image as api_gen_image

• Confidence: 96% confidence
• Finding: The script installs requests dynamically during execution if it is missing. Runtime dependency installation introduces remote code execution risk through package retrieval and allows the skill to change the host environment without explicit consent.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        from PIL import Image, ImageDraw, ImageFont
    except ImportError:
        subprocess.run([sys.executable, "-m", "pip", "install", "Pillow", "-q"], check=True)
        from PIL import Image, ImageDraw, ImageFont

    images = []

• Confidence: 96% confidence
• Finding: Automatically installing Pillow during execution exposes the host to supply-chain risk and unreviewed code execution. In a media-processing skill this is especially risky because the behavior is hidden behind normal fallback logic and may occur unexpectedly on first run.

Tainted flow: 'upload_url' from requests.post (line 249, network input) → requests.put (network output)

Medium

• Category: Data Flow

Content

put_headers["Content-Type"] = "application/octet-stream"
        with open(local_path, "rb") as f:
            file_data = f.read()
        resp2 = _requests.put(upload_url, headers=put_headers, data=file_data, timeout=180)
        if resp2.status_code not in (200, 204):
            raise RuntimeError(f"[步骤二] 上传到 OSS 失败（{resp2.status_code}）：{resp2.text[:200]}")

• Confidence: 88% confidence
• Finding: The upload URL used for PUT is taken directly from a prior network response and then sent the full local file contents. If the upstream platform or response is compromised, the skill will exfiltrate user media to an attacker-controlled destination, creating an SSRF-like trusted redirect for data upload.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill documents capabilities to read/write local files, access environment variables, invoke shell commands, and make network requests, but it does not declare permissions accordingly. This weakens user/admin visibility into what the skill can do and increases the chance that sensitive files, secrets, or user media are accessed or exfiltrated without informed approval.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented behavior materially exceeds the stated purpose: it can upload local audio/photos to external services and generate media remotely, not merely assemble user-provided images into a local slideshow video. This creates a significant transparency and data-handling risk because users may provide sensitive voice samples or portraits without realizing they will be transmitted to third-party infrastructure.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The documentation is internally inconsistent about whether voice identifiers are persisted: one section shows voice_id stored in configuration, while another says voice_id is only valid for the current run and is not written to config. For voice-cloning workflows, this ambiguity can cause unsafe handling of reusable biometric-derived identifiers and mislead users about persistence and privacy exposure.

Intent-Code Divergence

Medium

• Confidence: 82% confidence
• Finding: The API-key instructions conflict on whether the skill must halt without an API key or may continue in degraded mode using edge-tts/Pillow. Contradictory security and execution guidance can cause operators or agents to take unintended branches, including invoking networked services without clear authorization expectations.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The skill claims it does not rely on large-model video generation for cost control, yet later describes model-based image generation and talking-head video generation through wan2.7 services. This is a misleading representation of processing behavior that can hide privacy, compliance, and cost implications from users and reviewers.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Runtime package installation is not necessary for the core purpose of this skill and introduces an avoidable supply-chain and command-execution risk. Even though the command arguments are static, fetching and installing packages during execution can lead to unreviewed code being installed in the agent environment.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The script's runtime dependency installation is unnecessary for its core purpose and introduces avoidable risk. Pulling packages during execution increases exposure to package-repo compromise, dependency confusion, and unauthorized environment changes, especially in automated agent execution paths.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill metadata says it creates slideshow videos from user-provided images, but the code can silently generate missing or all images from script text using remote image-generation APIs. This is a security-relevant capability mismatch because it causes unadvertised external transmission of user content and changes the data-processing behavior materially.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The manifest does not disclose that local audio files and portrait images are uploaded to an external OSS/platform service. In a voice-cloning/video skill this is especially sensitive because user biometrics and personal media are transmitted off-host, which creates privacy, consent, and data-governance risk.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The documentation claims cloned voice IDs are only used in memory and not written to disk, but later code persists the voice_id to voice_config.json. This mismatch can mislead users and operators about retention of biometric-related identifiers and creates a privacy/security issue through unexpected persistence.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill instructs uploading user photos and audio to platform.delilegal.com and OSS for processing but does not provide an explicit privacy warning or consent step before transfer. Because portraits and voice recordings are sensitive personal data, silent upload to third-party services materially increases privacy, compliance, and misuse risk.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill advertises voice cloning without a prominent warning that it processes biometric-like voice samples and can create reusable synthetic voice output. Voice cloning is highly sensitive and can enable impersonation, fraud, and long-term misuse if users do not fully understand the consequences and consent boundaries.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill performs an external side effect—installing software—without any user-facing warning or confirmation. Silent package installation reduces transparency and can violate execution expectations, especially in constrained or high-trust agent environments where subprocess execution should be explicit and controlled.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: When --audio-file is used, the script base64-encodes local audio and transmits it to a remote enrollment endpoint, but it provides no explicit warning, consent checkpoint, or data-handling notice. Because voice samples are sensitive biometric-like data, silent transfer to a third-party platform materially increases privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The code writes API credentials to a local JSON config file without any explicit warning, encryption, permission hardening, or secret-store integration. On shared systems or agent hosts this can expose reusable platform credentials to other users or processes.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Local audio is uploaded to a remote platform service without an explicit privacy warning or consent checkpoint. Because this skill performs voice cloning, the uploaded audio may contain sensitive biometric voice data, making undisclosed transmission materially more dangerous than ordinary media processing.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The script recursively deletes the entire output directory if it already exists, with no confirmation prompt or allowlist. Because the output path is user-controlled, a mistaken or maliciously influenced path could lead to destructive data loss of arbitrary directories accessible to the process.

External Transmission

Medium

• Category: Data Exfiltration

Content

save_url = "https://platform.delilegal.com/api/v1/file/saveFile"

    # 步骤一：获取上传临时链接
    resp1 = _requests.post(
        prepare_url,
        headers=platform_headers,
        json={"fileHash": file_hash, "fileName": file_name},

• Confidence: 89% confidence
• Finding: This network call sends file metadata to an external service as part of an upload workflow. External transmission is expected for the feature, but it is security-relevant because the skill does not prominently disclose these uploads in metadata or require explicit user approval for sensitive media.

Static analysis

No suspicious patterns detected.