Back to skill

Security audit

Short Video Auto Editing

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent short-video generation workflow, with ordinary local media processing and a disclosed Edge TTS dependency but limited privacy disclosure.

Before installing, treat this as a Chinese-language short-video automation guide. Use it on media and copy you are comfortable processing with Edge TTS, confirm output paths before batch runs, and avoid sensitive unpublished customer or business text unless you accept the TTS service handling it.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The natural-language instructions, examples, and operational guidance are entirely in Chinese, and the document does not state that the skill is region-specific or provide an opt-in language/locale choice. This can violate language/locale policy when a skill implicitly forces one language without user choice or justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill uses Edge TTS to generate audio, which implies sending text content to an external network service, but the documentation does not disclose that network dependency or the associated privacy implications. If users include sensitive business copy, customer data, or unpublished campaign text, that content may be transmitted off-device without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

This markdown file describes automatic generation and export of videos into an output directory, but it does not clearly warn users that the skill will create and save files on the local filesystem. For markdown files, user-facing documentation should disclose behaviors that affect user data or system state.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.