Video analyze by doubao2.0

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:41 AM UTC
• Version: 1.0.1

Overview

The skill is a mostly coherent video-analysis integration, but it asks agents to install an unpinned SDK into the active Python environment and has under-scoped handling for downloaded remote videos.

Install only if you are comfortable sending selected videos or video URLs to Volcengine Ark and exposing ARK_API_KEY to this script. Use an isolated virtual environment with a pinned, reviewed SDK version, and manually delete any downloaded workspace/video files after use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:27
• Finding: Unpinned Third-Party Dependency Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 27–31 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```markdown 2. Directly run the following bash command to ensure that the current Python environment has the OpenAI dependency: ```bash pip install 'volcengine-python-sdk[ark]' ``` ``` ### Technical Analysis The Skill instructs the agent to install the latest available release of `volcengine-python-sdk[ark]` directly into the active Python environment. It does not pin an audited version, verify package hashes, use a lockfile, or require an isolated virtual environment. Installing a Python package may execute package-controlled installation logic and introduces transitive dependencies whose versions can change independently. Consequently, the code that runs during future Skill invocations is not fully represented by the audited project. This creates a supply-chain risk if the named package, one of its dependencies, or the configured package index is compromised. This finding does not establish that the named package is malicious. The vulnerability is the uncontrolled and non-reproducible dependency installation procedure. ### Attack Path 1. An attacker compromises a future release of the dependency, one of its transitive dependencies, or the package-index delivery path. 2. The agent follows `SKILL.md` and executes the unpinned `pip install` command. 3. The package manager downloads the attacker-controlled release and may execute its installation logic. 4. Malicious code runs with the privileges of the account invoking the Skill. 5. That code could access files and environment variables available to the process, including `ARK_API_KEY`, alter the Python environment, or modify subsequent video-analysis behavior. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the invoking user's privileges. The accessible sc ...[truncated 311 chars]
• Remediation: ## Remediation Suggestions - Pin the SDK and all transitive dependencies to reviewed versions in a lockfile. - Require package hashes, such as with `pip install --require-hashes -r requirements.txt`. - Install dependencies in a dedicated, non-privileged virtual environment rather than the active global environment. - Use a trusted package index and retain provenance or integrity metadata for approved artifacts. - Periodically scan and deliberately update locked dependencies after security review. - Package the Skill with reproducible environment metadata instead of instructing the agent to install the latest release at runtime.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Natural-Language Policy Violations

High

• Confidence: 95% confidence
• Finding: L22 要求“直接通知用户错误内容”，且整份技能说明均以中文固定编写，未说明应根据用户语言偏好返回结果，也未提供语言选择。这会导致技能在未获用户同意的情况下默认强制特定语言，属于语言/locale 策略违例。

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

import os
import sys
import argparse
import base64
from volcenginesdkarkruntime import AsyncArk
import asyncio

api_key = os.getenv('ARK_API_KEY')

def parse_args():
    parser = argparse.ArgumentParser(description='Parse video content using AI model')
    parser.add_argument('--prompt', type=str, required=True, help='The prompt text to send to the model')
    parser.add_argument('--video', type=str, required=True, help='Path to the local video file or remote video URL')
    parser.add_argument('--remote', action='store_true', help='Treat --video as a remote video URL instead of local file')
    return parser.parse_args()

def encode_video_to_base64(video_path):
    with open(video_path, 'rb') as video_file:
        return base64.b64encode(video_file.read()).decode('utf-8')

def get

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares access to environment secrets via metadata requirements but does not define an explicit tool scope such as permissions or allowed-tools. This weakens execution boundaries and can allow broader-than-intended tool usage or secret exposure during skill invocation, especially because the skill also instructs command execution and outbound API use.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger condition is broad enough that the skill may activate for many generic video-related tasks without sufficient narrowing. Over-broad routing can increase unnecessary transfer of video content to a third-party API and cause the agent to choose this skill in situations where a safer or more appropriate local workflow exists.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The document first instructs the agent to never use web-fetch style retry behavior for remote videos, but later tells it to download remote videos into the workspace and analyze them locally. This contradiction can cause unsafe fallback behavior, inconsistent enforcement, and accidental handling of untrusted remote content in ways the earlier safety guidance appeared to forbid.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to run a package installation command that modifies the user's environment without requiring prior notice or confirmation. Unprompted dependency installation can alter system state, introduce supply-chain risk, and violate least-surprise expectations for users operating in sensitive environments.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill recommends downloading remote videos into the local workspace without clear warning about local persistence, sensitive content retention, or cleanup. This can expose confidential media to unintended local storage, backup systems, or later access by other processes, especially since video content may contain highly sensitive information.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: When the --remote flag is used, the script forwards arbitrary remote video URLs to an external AI service without warning the user that the URL and referenced content will be shared with a third party. In a skill designed to process local or remote videos, this context makes the issue more plausible and dangerous because users may assume the tool only fetches or analyzes the URL locally rather than disclosing it externally.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script uploads local video content to a third-party AI service and prints the remote service response, but it provides no explicit user-facing disclosure, consent prompt, or data-handling warning. In an agent skill context, this is risky because users may provide sensitive local recordings without realizing the content is being transferred off-host to an external provider.

Static analysis

No suspicious patterns detected.