Jianying Video Gen

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:03 AM UTC
• Version: 1.0.0

Overview

The skill is broadly aligned with Jianying video generation, but it ships and uses browser login cookies and can upload local files to a third-party service with weak guardrails.

Review before installing. Remove the bundled cookies.json, revoke or rotate any exposed Jianying sessions, and use a fresh user-controlled cookie file only in an isolated environment. Run the skill under a low-privilege account with access only to approved media and output folders, avoid sensitive prompts or files, and expect Jianying account credits to be consumed when generation is submitted.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: cookies.json:1

Finding

Authentication Session Credentials Committed to the Project

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: mcp_server.py:105

Finding

MCP Tools Permit Upload of Arbitrary Readable Local Files

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Mutable and Unverified Third-Party Dependencies

Content

View full analysis

=1.42.0 requests>=2.31.0 ``` The installation instructions also resolve mutable package releases and download a browser artifact: ```bash pip install playwright && playwright install chromium ``` ### Technical Analysis Lower-bound-only constraints allow package managers to install any future release satisfying the minimum version. The project has no lockfile, package hashes, documented package index restrictions, or browser artifact integrity policy. As a result, two installations at different times can receive materially different code. Python package installation can execute package build or installation behavior with the privileges of the installing user. Playwright's browser installation command additionally downloads and installs a Chromium artifact. This creates avoidable exposure to future upstream compromise, dependency substitution through an untrusted index, and incompatible releases. The audit found no evidence that the currently named packages are typosquatted or intentionally malicious. The weakness is the mutable and unverified dependency process. `requests` also appears unused in the reviewed Python code, unnecessarily expanding the dependency surface. ### Attack Path 1. A user follows the documented installation procedure. 2. `pip` resolves the latest package versions accepted by the open-ended constraints from the configured package index. 3. A compromised future release, compromised index, or maliciously substituted package is downloaded. 4. Package installation or subsequent import executes attacker-controlled code with the user's privileges. 5. `playwright install chromium` separately downloads a browser artifact whose selected revision depends on the inst ...[truncated 465 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/jianying_worker.py:91

Finding

Chromium Security Sandbox Explicitly Disabled

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

A skill that claims to generate videos but instead mainly queries status and downloads files to a fixed local path creates a significant transparency and file-safety issue. Undisclosed local file writes, especially to a hardcoded directory, can overwrite data, leak sensitive outputs into predictable locations, and bypass user expectations about where authenticated downloads will be stored.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A skill that claims to generate videos but instead mainly queries status and downloads files to a fixed local path creates a significant transparency and file-safety issue. Undisclosed local file writes, especially to a hardcoded directory, can overwrite data, leak sensitive outputs into predictable locations, and bypass user expectations about where authenticated downloads will be stored.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill documentation shows shell execution and file access behavior but does not declare any tool scope or allowed-tools boundaries. This weakens least-privilege controls and makes it easier for an agent runtime to invoke broader local capabilities than users may expect, especially because the skill handles credential files and output paths.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This skill relies on valid login cookies to perform automated actions on a user's Jianying account, but the description does not prominently warn that account authentication material is required and will be used. Because cookies function as bearer credentials, unclear disclosure increases the risk of accidental credential exposure, misuse of a personal account, or unauthorized billable actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The workflow uploads prompts and optional local images/videos to a third-party service, but the description does not clearly inform users of this data transfer. In this context, the omission is more dangerous because the skill is explicitly designed to automate media submission to an external platform, so users may unknowingly send sensitive local files or confidential prompts off-device.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest describes a skill for generating AI videos via Jianying/Seedance and requiring cookies.json credentials. In this file, tool execution is delegated by launching a separate local process with subprocess.run, which is a more powerful host-execution capability than the stated purpose requires and is not disclosed in the manifest description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The tool automatically uses local authentication material from cookies.json to perform network-backed actions through a subprocess, without any explicit consent gate or warning at call time. In an agent setting, this increases the risk of unintended use of a logged-in account, unexpected credit consumption, or actions performed under sensitive local credentials if the tool is invoked indirectly or deceptively.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code automatically creates the requested output directory and proceeds with video generation output, which affects the user's filesystem. Although the tool schema includes an output_dir parameter, there is no explicit warning, confirmation, or comment here disclosing that the skill will create directories and save files to disk.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · mcp_server.py (reported line 252)May include surrounding context.

python

# 执行命令
        try:
            import subprocess
            result = subprocess.run(
                cmd,
                capture_output=True,
                text=True,

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest describes a skill for using Jianying's Seedance model to generate videos in T2V/I2V/V2V modes, but this file is focused on querying an existing task and persisting the resulting video to local storage. Downloading generated assets may be related operationally, yet the manifest does not mention retrieval or local file export behavior, so the implemented behavior is broader than the declared purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script loads cookies from a local credential file and injects them into a browser context for authenticated access, but it provides no meaningful consent, validation, or scoping controls around that credential use. If the skill is triggered unexpectedly or the cookies file contains broader session tokens than intended, it can act on the user's behalf against the Jianying account without clear user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The code performs authenticated requests to a discovered video URL and writes the response body directly to disk without validating the destination URL, content origin, or file safety characteristics. If the page content or extracted URL is manipulated, the script could download unintended remote content using authenticated browser state and persist it locally without user review.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module header and user-facing behavior indicate the skill is intended to be operated in Chinese, and the rest of the script also emits Chinese prompts and status text. For an all-file policy check, forcing a specific language without opt-in is a natural-language locale policy issue unless the file clearly states that the skill is region- or language-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill programmatically injects cookies into a browser context and automates an authenticated session, but it provides no explicit warning, consent checkpoint, or scoping controls around use of a real user account. In an agent-skill setting, this can lead to unintended account actions, session misuse, or handling of sensitive authentication material without adequate operator awareness.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest describes a Jianying/Seedance automation skill for generating AI videos, which reasonably implies browser automation and network access to Jianying. Spawning a local subprocess to execute curl adds host-command execution capability that is not an obvious requirement of that purpose, especially since the script already has browser/network primitives available.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/jianying_worker.py (reported line 638)May include surrounding context.

python

# === Step 10: curl 下载 ===
        print(f" [Step 10] Downloading to {filepath}...")
        import subprocess
        result = subprocess.run(
            ['curl', '-L', '-o', filepath, '-s', '-w', '%{http_code}', mp4_url],
            capture_output=True, text=True, timeout=120
        )

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The tool descriptions, parameter descriptions, and enum values are presented only in Chinese, which imposes a specific language/locale on users. The file does not indicate that Chinese is optional, configurable, or justified as a region-specific requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This markdown file contains natural-language guidance that privileges Chinese as the expected prompt language. Under the policy, forcing or steering users toward a specific language without an explicit opt-in can be a locale/language policy issue.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency specifier uses a lower bound only, which allows future major or minor releases of Playwright to be installed without review. This creates supply-chain and reliability risk because a later release could introduce a vulnerable or incompatible version into the skill environment.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

playwright>=1.42.0
requests>=2.31.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

requests>=2.31.0 is not pinned to an exact version, so installations may resolve to different releases over time. Because requests is security-sensitive network client code and has a history of advisories, leaving it unpinned increases the chance of pulling an unreviewed or affected version into the environment.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

playwright>=1.42.0
requests>=2.31.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

The manifest includes requests without an exact version, and the package has multiple known advisories across its release history. Since this skill automates web interactions and may handle authenticated sessions or cookies, an affected requests version could expose credentials, weaken TLS/request validation behavior, or otherwise increase attack surface.

Content

No source excerpt is available for this finding.