Jianying Video Gen

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:03 AM UTC
• Version: 1.0.0

Overview

The skill is broadly aligned with Jianying video generation, but it ships and uses browser login cookies and can upload local files to a third-party service with weak guardrails.

Review before installing. Remove the bundled cookies.json, revoke or rotate any exposed Jianying sessions, and use a fresh user-controlled cookie file only in an isolated environment. Run the skill under a low-privilege account with access only to approved media and output folders, avoid sensitive prompts or files, and expect Jianying account credits to be consumed when generation is submitted.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: cookies.json:1
• Finding: Authentication Session Credentials Committed to the Project<![CDATA[ ## Vulnerability Details **File Location**: `cookies.json:1` **Vulnerability Type**: Hardcoded authentication credentials and plaintext sensitive data **Risk Level**: High ### Vulnerable Code The project contains a browser cookie export with Jianying authentication and session credentials. Sensitive values are redacted below to prevent further disclosure: ```json [ { "domain": ".xyq.jianying.com", "httpOnly": true, "name": "uid_tt_ss_pippitcn_web", "path": "/", "secure": true, "value": "[REDACTED]" }, { "domain": ".xyq.jianying.com", "httpOnly": true, "name": "ssid_ucp_v1_pippitcn_web", "path": "/", "secure": true, "value": "[REDACTED]" }, { "domain": ".jianying.com", "httpOnly": false, "name": "passport_csrf_token", "path": "/", "secure": true, "value": "[REDACTED]" }, { "domain": ".xyq.jianying.com", "httpOnly": true, "name": "session_tlb_tag_pippitcn_web", "path": "/", "secure": true, "value": "[REDACTED]" }, { "domain": ".xyq.jianying.com", "httpOnly": true, "name": "sessionid_ss_pippitcn_web", "path": "/", "secure": true, "value": "[REDACTED]" }, { "domain": ".xyq.jianying.com", "httpOnly": true, "name": "sid_ucp_v1_pippitcn_web", "path": "/", "secure": true, "value": "[REDACTED]" } ] ``` ### Technical Analysis The checked-in file contains account identifiers, session IDs, authentication-state cookies, and a CSRF token. The worker explicitly imports these values into a browser context: ```python cookies = load_and_clean_cookies() await context.add_cookies(cookies) ``` Consequently, possession of the project can provide the same browser authentication state that the automation uses. The `httpOnly` attribute only prevents browser-side JavaScript from reading a cookie; it does not protect a cookie already exposed in a file. The recorded expiration timestamps may now have elap ...[truncated 1213 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Immediately revoke all exposed sessions by signing out active sessions, rotating credentials where supported, and regenerating CSRF/session material. 2. Delete `cookies.json` from the project and purge it from all version-control history and published artifacts. 3. Add `cookies.json` and similar browser-export files to `.gitignore`. 4. Distribute only a non-secret `cookies.example.json` containing placeholders. 5. Load credentials at runtime from a user-controlled secret store or a protected path outside the project. 6. Restrict secret-file permissions to the account running the worker. 7. Add secret scanning to pre-commit hooks and CI, including rules for session cookie names used by the service. 8. Ensure logs and error responses never include cookie values. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: mcp_server.py:105
• Finding: MCP Tools Permit Upload of Arbitrary Readable Local Files<![CDATA[ ## Vulnerability Details **File Location**: `mcp_server.py:105-148, 221-238`; `scripts/jianying_worker.py:64-72, 181, 396` **Vulnerability Type**: Unrestricted caller-controlled local file access and remote upload **Risk Level**: High ### Vulnerable Code The MCP schemas accept unrestricted filesystem paths: ```python "image_path": { "type": "string", "description": "参考图片路径" }, ``` ```python "video_path": { "type": "string", "description": "参考视频路径" }, ``` Those values are passed directly to the worker: ```python elif name == "image_to_video": cmd.extend([ "--ref-image", arguments["image_path"], "--prompt", arguments["prompt"], "--duration", arguments.get("duration", "10s"), "--ratio", arguments.get("ratio", "横屏"), "--model", arguments.get("model", "Seedance 2.0") ]) elif name == "video_to_video": cmd.extend([ "--ref-video", arguments["video_path"], "--prompt", arguments["prompt"], "--duration", arguments.get("duration", "10s"), "--ratio", arguments.get("ratio", "横屏"), "--model", arguments.get("model", "Seedance 2.0") ]) ``` The worker checks only whether a path exists: ```python if ref_video and not os.path.exists(ref_video): print(f"[错误] 参考视频文件不存在: {ref_video}") return if ref_image and not os.path.exists(ref_image): print(f"[错误] 参考图片文件不存在: {ref_image}") return ``` It then uploads the selected file to the remote Jianying service: ```python file_chooser = await fc_info.value await file_chooser.set_files(ref_image) ``` ```python file_chooser = await fc_info.value await file_chooser.set_files(ref_video) ``` ### Technical Analysis The MCP caller controls `image_path` and `video_path`. The server performs no canonical-path validation, allowed-directory enforcement, symlink rejection, file-type verification, size limit, or user confirmation before the browser reads and uploads the selected file. Although the subproces ...[truncated 1682 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Define a dedicated media-input directory and reject files outside it. 2. Resolve each path with `Path.resolve()` and verify it remains under the authorized root using `Path.is_relative_to()` or an equivalent safe check. 3. Reject symlinks and revalidate the opened file to reduce time-of-check/time-of-use substitution. 4. Verify file signatures and MIME types rather than trusting extensions. 5. Apply explicit extension and size allowlists for supported image and video formats. 6. Require user confirmation that displays the canonical local path, destination service, file type, and size before upload. 7. Run the MCP server under a dedicated, minimally privileged operating-system account with access only to approved media directories. 8. Consider replacing arbitrary path arguments with opaque file handles or resource identifiers selected through a trusted file-picker workflow. 9. Record security audit events for attempted access outside the allowlisted directory without logging sensitive file contents. ]]>

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1
• Finding: Mutable and Unverified Third-Party Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:1-2`; `SKILL.md:15-20` **Vulnerability Type**: Unpinned software supply-chain dependencies **Risk Level**: Medium ### Vulnerable Code The dependency file uses unrestricted upper versions: ```text playwright>=1.42.0 requests>=2.31.0 ``` The installation instructions also resolve mutable package releases and download a browser artifact: ```bash pip install playwright && playwright install chromium ``` ### Technical Analysis Lower-bound-only constraints allow package managers to install any future release satisfying the minimum version. The project has no lockfile, package hashes, documented package index restrictions, or browser artifact integrity policy. As a result, two installations at different times can receive materially different code. Python package installation can execute package build or installation behavior with the privileges of the installing user. Playwright's browser installation command additionally downloads and installs a Chromium artifact. This creates avoidable exposure to future upstream compromise, dependency substitution through an untrusted index, and incompatible releases. The audit found no evidence that the currently named packages are typosquatted or intentionally malicious. The weakness is the mutable and unverified dependency process. `requests` also appears unused in the reviewed Python code, unnecessarily expanding the dependency surface. ### Attack Path 1. A user follows the documented installation procedure. 2. `pip` resolves the latest package versions accepted by the open-ended constraints from the configured package index. 3. A compromised future release, compromised index, or maliciously substituted package is downloaded. 4. Package installation or subsequent import executes attacker-controlled code with the user's privileges. 5. `playwright install chromium` separately downloads a browser artifact whose selected revision depends on the inst ...[truncated 465 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin each direct and transitive dependency to reviewed exact versions. 2. Generate a reproducible lockfile with cryptographic hashes, such as a hash-locked requirements file produced by `pip-tools`. 3. Install with hash enforcement, for example `pip install --require-hashes -r requirements.lock`. 4. Restrict installations to an explicitly trusted package index and disable unintended supplemental indexes. 5. Pin and document the expected Playwright Chromium revision and verify downloaded artifacts through the vendor-supported integrity mechanism. 6. Perform dependency vulnerability and provenance checks in CI. 7. Remove `requests` if it is not used. 8. Schedule controlled dependency updates rather than resolving arbitrary future releases during deployment. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/jianying_worker.py:91
• Finding: Chromium Security Sandbox Explicitly Disabled<![CDATA[ ## Vulnerability Details **File Location**: `scripts/jianying_worker.py:91-94`; `scripts/download_video.py:91-94` **Vulnerability Type**: Unsafe browser execution configuration **Risk Level**: Medium ### Vulnerable Code Both browser-launching scripts disable Chromium sandbox protections: ```python browser = await p.chromium.launch( headless=True, args=['--no-sandbox', '--disable-setuid-sandbox'] ) ``` The same configuration appears in `scripts/download_video.py`: ```python browser = await p.chromium.launch( headless=True, args=['--no-sandbox', '--disable-setuid-sandbox'] ) ``` ### Technical Analysis Chromium's sandbox limits the privileges and host access available to compromised renderer and browser subprocesses. The `--no-sandbox` and `--disable-setuid-sandbox` options explicitly remove those protections. The Skill loads remote Jianying pages, dynamic page scripts, generated media, and externally supplied MP4 URLs discovered in page content. If any loaded content exploits a browser vulnerability, disabling the sandbox increases the chance that the exploit can access resources available to the Python process and host user. This configuration is particularly sensitive because the same process environment handles authentication cookies and caller-selected local files. The audit did not identify a browser exploit in the project; exploitation requires a separate browser or rendering vulnerability. ### Attack Path 1. The worker launches Chromium with both sandbox-disabling flags. 2. Chromium navigates to remote service pages or processes remotely hosted media. 3. Malicious or compromised remote content triggers a Chromium rendering, media-decoding, or browser-process vulnerability. 4. Because the normal sandbox boundary is disabled, post-exploitation code has fewer containment barriers. 5. The attacker accesses data or capabilities available to the Skill's operating-system account. ### Impact Assessment Potential impact inclu ...[truncated 381 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `--no-sandbox` and `--disable-setuid-sandbox`. 2. Run Chromium as a non-root user in an environment that supports its standard sandbox. 3. If containerization is required, configure namespaces and required kernel capabilities correctly instead of disabling the browser sandbox. 4. Add defense-in-depth container restrictions, including a read-only root filesystem, minimal mounted directories, a restrictive seccomp profile, dropped Linux capabilities, and network egress controls. 5. Keep Chromium and Playwright pinned to reviewed, security-supported versions and apply browser security updates promptly. 6. Separate browser automation from sensitive host resources and expose only the exact input/output directories required for each job. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: A skill that claims to generate videos but instead mainly queries status and downloads files to a fixed local path creates a significant transparency and file-safety issue. Undisclosed local file writes, especially to a hardcoded directory, can overwrite data, leak sensitive outputs into predictable locations, and bypass user expectations about where authenticated downloads will be stored.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: A skill that claims to generate videos but instead mainly queries status and downloads files to a fixed local path creates a significant transparency and file-safety issue. Undisclosed local file writes, especially to a hardcoded directory, can overwrite data, leak sensitive outputs into predictable locations, and bypass user expectations about where authenticated downloads will be stored.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill documentation shows shell execution and file access behavior but does not declare any tool scope or allowed-tools boundaries. This weakens least-privilege controls and makes it easier for an agent runtime to invoke broader local capabilities than users may expect, especially because the skill handles credential files and output paths.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This skill relies on valid login cookies to perform automated actions on a user's Jianying account, but the description does not prominently warn that account authentication material is required and will be used. Because cookies function as bearer credentials, unclear disclosure increases the risk of accidental credential exposure, misuse of a personal account, or unauthorized billable actions.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The workflow uploads prompts and optional local images/videos to a third-party service, but the description does not clearly inform users of this data transfer. In this context, the omission is more dangerous because the skill is explicitly designed to automate media submission to an external platform, so users may unknowingly send sensitive local files or confidential prompts off-device.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The manifest describes a skill for generating AI videos via Jianying/Seedance and requiring cookies.json credentials. In this file, tool execution is delegated by launching a separate local process with subprocess.run, which is a more powerful host-execution capability than the stated purpose requires and is not disclosed in the manifest description.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The tool automatically uses local authentication material from cookies.json to perform network-backed actions through a subprocess, without any explicit consent gate or warning at call time. In an agent setting, this increases the risk of unintended use of a logged-in account, unexpected credit consumption, or actions performed under sensitive local credentials if the tool is invoked indirectly or deceptively.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This code automatically creates the requested output directory and proceeds with video generation output, which affects the user's filesystem. Although the tool schema includes an output_dir parameter, there is no explicit warning, confirmation, or comment here disclosing that the skill will create directories and save files to disk.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 执行命令
        try:
            import subprocess
            result = subprocess.run(
                cmd,
                capture_output=True,
                text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The manifest describes a skill for using Jianying's Seedance model to generate videos in T2V/I2V/V2V modes, but this file is focused on querying an existing task and persisting the resulting video to local storage. Downloading generated assets may be related operationally, yet the manifest does not mention retrieval or local file export behavior, so the implemented behavior is broader than the declared purpose.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script loads cookies from a local credential file and injects them into a browser context for authenticated access, but it provides no meaningful consent, validation, or scoping controls around that credential use. If the skill is triggered unexpectedly or the cookies file contains broader session tokens than intended, it can act on the user's behalf against the Jianying account without clear user awareness.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code performs authenticated requests to a discovered video URL and writes the response body directly to disk without validating the destination URL, content origin, or file safety characteristics. If the page content or extracted URL is manipulated, the script could download unintended remote content using authenticated browser state and persist it locally without user review.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The module header and user-facing behavior indicate the skill is intended to be operated in Chinese, and the rest of the script also emits Chinese prompts and status text. For an all-file policy check, forcing a specific language without opt-in is a natural-language locale policy issue unless the file clearly states that the skill is region- or language-specific.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill programmatically injects cookies into a browser context and automates an authenticated session, but it provides no explicit warning, consent checkpoint, or scoping controls around use of a real user account. In an agent-skill setting, this can lead to unintended account actions, session misuse, or handling of sensitive authentication material without adequate operator awareness.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The manifest describes a Jianying/Seedance automation skill for generating AI videos, which reasonably implies browser automation and network access to Jianying. Spawning a local subprocess to execute `curl` adds host-command execution capability that is not an obvious requirement of that purpose, especially since the script already has browser/network primitives available.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# === Step 10: curl 下载 ===
        print(f" [Step 10] Downloading to {filepath}...")
        import subprocess
        result = subprocess.run(
            ['curl', '-L', '-o', filepath, '-s', '-w', '%{http_code}', mp4_url],
            capture_output=True, text=True, timeout=120
        )

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The tool descriptions, parameter descriptions, and enum values are presented only in Chinese, which imposes a specific language/locale on users. The file does not indicate that Chinese is optional, configurable, or justified as a region-specific requirement.

Natural-Language Policy Violations

Low

• Confidence: 81% confidence
• Finding: This markdown file contains natural-language guidance that privileges Chinese as the expected prompt language. Under the policy, forcing or steering users toward a specific language without an explicit opt-in can be a locale/language policy issue.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

playwright>=1.42.0
requests>=2.31.0

• Confidence: 95% confidence
• Finding: The dependency specifier uses a lower bound only, which allows future major or minor releases of Playwright to be installed without review. This creates supply-chain and reliability risk because a later release could introduce a vulnerable or incompatible version into the skill environment.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

playwright>=1.42.0
requests>=2.31.0

• Confidence: 98% confidence
• Finding: `requests>=2.31.0` is not pinned to an exact version, so installations may resolve to different releases over time. Because `requests` is security-sensitive network client code and has a history of advisories, leaving it unpinned increases the chance of pulling an unreviewed or affected version into the environment.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 92% confidence
• Finding: The manifest includes `requests` without an exact version, and the package has multiple known advisories across its release history. Since this skill automates web interactions and may handle authenticated sessions or cookies, an affected `requests` version could expose credentials, weaken TLS/request validation behavior, or otherwise increase attack surface.

Static analysis

No suspicious patterns detected.