Security audit

topic-to-video

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent video-production skill with disclosed local rendering, optional cloud services, and no evidence of hidden exfiltration or persistence.

Install only if you are comfortable with a local video-rendering pipeline that can run ffmpeg/Chrome/Node/Python tools, perform web research, send narration or prompts to selected TTS/image providers, fetch Wikimedia images, and copy finished files to Desktop or Downloads. Keep API keys out of chat, use only trusted provider base URLs, and review paid-service/image-generation choices before enabling them.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (501)

Tainted flow: 'key' from os.environ.get (line 146, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/tts.py (reported line 42)May include surrounding context.
python
key = os.environ.get("OPENAI_API_KEY") or _read_key_file("~/.openai_key") if not key: raise RuntimeError("no OPENAI_API_KEY") r = requests.post( "https://api.openai.com/v1/audio/speech", headers={"Authorization": f"Bearer {key}"}, json={"model": "gpt-4o-mini-tts", "voice": voice, "input": text},

Tainted flow: 'url' from os.environ.get (line 164, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/tts.py (reported line 167)May include surrounding context.
python
url = f"{base}?GroupId={group}" if group else base more = i < len(bases) - 1 try: r = requests.post(url, headers=headers, json=body, timeout=120) r.raise_for_status() j = r.json() except Exception as e: # network/HTTP: try the other host if we have one

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is for a full automatic explainer-video creation pipeline. The supplied code chunk instead implements a small front-end web component that reads HTML attributes (label, value, min, max, unit) and constructs a dial/gauge display in the DOM. Its behavior is limited to rendering a visual widget and setting a CSS variable for needle angle. It does not accept topics, slides, PDFs, image folders, or hand-offs; does not generate audio, visuals beyond the gauge widget, or video; and does not access external resources. This is a materially different primary purpose, so the description does not accurately represent the code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a full end-to-end explainer-video creation skill. The supplied code does not implement that workflow. Instead, it only adjusts CSS animation delays for DOM elements based on URL query parameters such as progress, duration, and cue timings, likely to freeze or seek an HTML scene at a given point. While such a helper could be a supporting component inside a larger video/slide animation system, this code chunk by itself is materially narrower and does not match the declared primary purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This code does not match the broad declared purpose. The description promises a general system that turns arbitrary topics or slide decks into narrated explainer videos with automated research, scripting, visuals, multilingual narration, and caption burn-in. The actual code chunk is merely a static TypeScript export of caption lines for one prewritten video. While captions could be a supporting part of a video pipeline, this chunk by itself demonstrates only fixed content for a specific project and none of the core declared capabilities. Therefore the supplied code chunk materially differs from the declared functionality.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is for an end-user video-generation skill that researches topics, writes scripts, produces narration, builds visuals, and renders narrated videos from slides or other inputs. The supplied code chunk does none of that. Instead, it is a low-level animation helper focused on SVG path traversal in a Remotion runtime: it measures path length, returns points and angles along a path, clamps traversal values, and caches lengths for performance. While such code could be a supporting internal component of a video-rendering system, this specific chunk's purpose is materially different from the declared skill behavior and exposes unrelated capabilities not reflected in the description. Therefore this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description promises a broad, user-facing system that turns topics or slide decks into narrated explainer videos. In contrast, the code shown is narrowly focused on SVG drawing animation behavior inside a Remotion runtime: normalizing path reveal with strokeDasharray/strokeDashoffset, supporting dashed stroke motion, and computing deterministic hand-drawn boil phases. These are animation helpers that could be a small internal component of a video system, but by themselves they do not implement or substantiate the declared end-to-end capabilities. The primary purpose of the code is materially different from the declared purpose, so this is a clear mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description promises a broad autonomous video-creation pipeline from topics, decks, PDFs, or images. The supplied code chunk does not implement any of those capabilities. Instead, it contains a single helper function, requireEvidence, whose purpose is to enforce that a visual component receives a non-empty image path and otherwise throw a detailed error about supplying a real artefact image. This is materially different from the claimed primary purpose and represents a clear description-to-behavior mismatch. While this utility could be a small internal part of a video system, the chunk itself only performs evidence asset validation and error messaging, not narrated video creation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a full pipeline for generating narrated explainer videos from topics or slide decks. The supplied code chunk does not implement any of those user-facing capabilities. Instead, it is a narrowly scoped helper for figure parsing and display: it trims text, validates whether a string represents exactly one number, preserves prefixes/suffixes, formats count-up animation frames, and returns numeric values for drawing. This is an internal rendering utility, not evidence of the described skill behavior. Because the actual code’s primary purpose is materially different and unrelated to the declared functionality, this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description promises a full automatic explainer-video pipeline: researching content, writing scripts, generating voiceovers, building visuals from topics or decks, and burning captions into videos. The supplied code chunk does none of that directly. Instead, it implements mathematical utilities for camera fitting in a 3D scene: projecting points, checking bounding boxes, computing camera distance to keep objects within reserved screen regions, and adjusting camera framing. While such functionality could be a supporting internal component of a video-rendering system, this chunk’s actual purpose is narrowly focused on 3D framing and is not accurately represented by the broad declared description when evaluated on its own. Therefore this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description promises a full pipeline for generating narrated explainer videos from topics or slide decks, including research, scripting, voice synthesis, visual creation, slide handling, and captions. The supplied code chunk does none of that. It is a narrowly scoped graphics helper for simulating focus/depth-of-field in rendered visuals, likely as one internal component of a video-rendering system. While such a utility could support visual styling in a video tool, this chunk’s actual behavior is far more limited and does not substantiate the declared end-user functionality. Therefore, the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description promises an end-to-end video-generation skill that accepts topics or slide decks and produces narrated explainer videos with visuals, voiceover, and captions. The supplied code does not implement any of those user-facing capabilities. Instead, it is a narrow rendering helper focused on preventing text baseline jitter during animated transforms in a Remotion/React runtime. While this could be a supporting component inside a larger video tool, this chunk’s actual purpose is materially different from the declared skill description and omits all of the headline functionality. Therefore this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The supplied code chunk does not implement or indicate any of the declared end-user functionality around creating narrated explainer videos from topics or slide decks. Instead, it only performs hex color parsing/normalization for rendering logic. This is at most a low-level visual helper, but by itself it is unrelated to the declared primary purpose and does not evidence the advertised capabilities. Therefore the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This code chunk does not implement or directly support the declared skill's stated purpose in any recognizable way beyond being a possible internal styling helper. Its actual function is narrowly focused on accessibility/color selection (onAccentInk) using contrast checks and readable fallbacks. That is materially different from a user-facing skill for automatically creating narrated explainer videos from topics or slide decks. Because the declared purpose describes a comprehensive media-production workflow while the code only performs design-system color logic, this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description promises a full workflow for generating narrated explainer videos from topics or slide decks. The supplied code does none of that. It only implements geometric helper functions for a 3D/rendering context: projecting a 3D point to 2D frame coordinates, placing points on a ring, and rotating a point around the Y axis. While such utilities could support visual labeling inside a video-rendering system, this is merely an internal rendering helper and not representative of the declared primary purpose. Therefore, the description does not accurately represent this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is for a full pipeline that generates narrated short videos from topics or slides. The supplied code does not implement any part of that user-facing functionality. Instead, it is a narrow runtime helper used to validate that a property is an array and to produce clearer error messages when the wrong data shape is passed. This is unrelated supporting infrastructure at best, but taken as the supplied code chunk, it does not accurately represent the declared primary purpose. Therefore this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a full end-to-end video creation skill: it should accept topics or decks, generate scripts, voice narration, build visuals, and output narrated videos with captions. The supplied code does not implement those behaviors. Instead, it defines static metadata and helper functions for shot luminance classification, ground color resolution, contrast-safe captioning, and flash/seam safety in a Remotion video runtime. These are supporting internals for a video system, but this chunk by itself is narrowly focused on visual contrast and transition safety rather than the declared high-level functionality. Because the actual behavior is materially different from the declared purpose and introduces undeclared capabilities centered on rendering safety analysis, this is a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This code chunk does not implement the declared user-facing functionality of creating narrated explainer videos from topics or slide decks. It is a narrow internal developer-support file for TypeScript type augmentation, enabling React JSX to recognize react-three-fiber intrinsic elements. While such typing support could be a supporting detail inside a video-generation project, this chunk by itself reflects a materially different purpose than the declared capability. There are no signs of media processing, TTS, slide handling, research, scripting, captioning, or triggers related to the described skill behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description promises a full-featured video creation pipeline. The supplied code chunk does not implement any of those behaviors; it is only a static empty fallback configuration exporting empty objects. This is a materially different purpose from the declared skill behavior, so the description does not accurately represent the code shown.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a full end-to-end video creation skill: researching a topic, generating narration, building visuals, handling slide decks, and burning captions into a final video. The supplied code does none of that. It is a narrow internal helper that reads local Remotion/TypeScript source files and extracts caption/layout constants and aspect ratios so Python QA/utilities can calculate caption size and reserved caption-band height consistently. While captions are mentioned in the declared description, this code is only a low-level supporting utility and not representative of the skill's stated primary behavior. Therefore the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This code is a low-level rendering utility for capturing visual frames from URLs using headless Chrome via the Chrome DevTools Protocol. While such frame capture could be a supporting component inside a larger video-generation system, the supplied chunk does not implement the declared user-facing behavior of turning topics or decks into narrated explainer videos. Its actual purpose is materially narrower and different: fast screenshot/frame capture for rendering. Because the declared description emphasizes end-to-end video production, narration, research, captions, and deck conversion, while the code only handles browser screenshot capture infrastructure, this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description promises an end-user-facing video-generation workflow: topic research, script writing, voice synthesis, visual generation, slide-to-video conversion, multilingual narration, and caption burn-in. The actual code does none of that. It is a project-internal Python audit utility that enumerates Remotion shot files, derives durations, renders still frames at settled timestamps, checks text safe/caption-band and edge overlap, caches results, reports debt changes, and can rewrite remotion/band_debt.json. This is a materially different primary purpose and includes undeclared file-writing behavior to an internal manifest. Therefore the description does not accurately represent the supplied code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description promises an end-to-end video generation capability from topics or slide decks. The supplied code does not research topics, generate scripts, create visuals, synthesize speech, process decks, or render videos. Its primary purpose is materially different: it is a preprocessing quality gate for a structured brief used before content planning. While such validation could be a supporting component inside a larger video pipeline, this chunk by itself implements a distinct QA function that is not represented by the declared skill description. Therefore, the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The code chunk is a narrow asset-generation helper for a video pipeline, not the described end-user skill itself. Its primary function is to 'bake' a webpage into a texture PNG plus layout metadata so another Remotion component can animate it. While this could support the declared visual-building portion of a video system, the supplied code does not itself implement the advertised core capabilities: no slide deck handling, no PDF/image-folder ingestion, no narration, no multilingual voiceover, no captioning, no storyboard/sample generation, and no final video creation. It also introduces behavior not mentioned in the description—capturing arbitrary URLs/local HTML pages and extracting DOM layout boxes. Because the actual behavior is materially narrower and partly different from the declared purpose, this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a full video-generation skill: it should ingest topics or slide decks and automatically research, script, voice, render visuals, and produce narrated videos with captions. The supplied code chunk does none of that. It is a deterministic validation script for an already-rendered output directory, checking out.mp4, .clips/, out.srt, and storyboard.json for synchronization and measurement completeness. This is not merely a supporting implementation detail like one helper among many; the code’s direct purpose is QA/sanity checking, and its behavior is materially different from the declared end-user functionality. Therefore the description does not accurately represent this code chunk.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/ink_contrast_qa.py:159