Filmora Video Enhancer

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:20 AM UTC
• Version: 1.0.9

Overview

The skill mostly matches its cloud video-enhancement purpose, but it has privacy and consent-boundary issues that users should review before installing.

Install only if you are comfortable uploading non-sensitive videos to Wondershare and with the provider receiving video metadata plus a stable device-level identifier. Before using it, verify the file is within the stated duration limits yourself, choose an output directory intentionally, and do not rely on the artifact's deletion claim unless the provider's retention terms independently confirm it.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/video_enhance.py:439

Finding

Documented Video Upload Limits Are Not Enforced

Content

View full analysis

1920`, duration must not exceed 60 seconds. The implementation only verifies that width, height, and duration are nonzero. It does not compare the extracted metadata against either declared duration limit. Consequently, a video outside the consented and documented processing constraints proceeds directly to `enhance()`, which uploads the complete source file. ...[truncated 1211 chars]

Remediation

View remediation

300: log_error( f"Video duration {video_duration:.1f}s exceeds the 300-second limit " "for videos at or below 1920 pixels." ) sys.exit(1) if max_dimension > 1920 and video_duration > 60: log_error( f"Video duration {video_duration:.1f}s exceeds the 60-second limit " "for videos above 1920 pixels." ) sys.exit(1) ``` Also: 1. Reject non-finite, negative, malformed, or missing metadata. 2. Keep all validation in a dedicated function invoked immediately before upload. 3. Add tests for 60-, 300-, and just-over-limit boundary values. 4. Ensure no network request occurs when validation fails. 5. Align the code, documentation, and provider-side limits so the declared consent boundary cannot diverge from actual behavior. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/video_enhance.py:228

Finding

Unvalidated Task Result URL Enables Arbitrary Resource Retrieval

Content

View full analysis

bool: """Download video from URL to local path""" log_info(f"Downloading enhanced video to: {output_path}") try: urllib.request.urlretrieve(url, output_path) if os.path.exists(output_path) and os.path.getsize(output_path) > 0: size_mb = os.path.getsize(output_path) / (1024 * 1024) log_info(f"Video saved: {output_path} ({size_mb:.1f}MB)") return True ``` ### Technical Analysis The `video_result` value is obtained from a remote task response and passed directly to `urllib.request.urlretrieve()` without validating its URL scheme, hostname, port, or resolved address. `SKILL.md` states that the final result must be downloaded through an HTTPS task-result URL. The implementation does not enforce that requirement. Depending on the URL handlers available to `urllib`, an attacker controlling or compromising the API response could direct the client toward an arbitrary web server, a local service, an internal-network address, or a non-HTTPS location. The retrieved response is then written to a path with a video extension without checking the response content type, expected size, or cryptographic integrity. ### Attack Path 1. An attacker compromises, intercepts, or otherwise influences the Wondershare task response, or the provider returns a malformed `video_result`. 2. The response contains a URL targeting an attacker-controlled host, an internal service, a loopback address, ...[truncated 1126 chars]

Remediation

View remediation

None: parsed = urlsplit(url) if parsed.scheme != "https": raise ValueError("The result URL must use HTTPS") if parsed.username or parsed.password: raise ValueError("Credentials in the result URL are not allowed") if parsed.port not in (None, 443): raise ValueError("Unexpected result URL port") if parsed.hostname not in ALLOWED_RESULT_HOSTS: raise ValueError("Unapproved result download host") ``` ]]>

other

Note

• Location: scripts/video_enhance.py:186

Finding

Stable Host and MAC-Derived Device Fingerprint Is Transmitted to the Cloud Provider

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The documented purpose is video enhancement with cloud upload, but the behavior also includes transmitting a persistent device identifier derived from computer name and MAC address, and the finding indicates locale/language is also sent. This is dangerous because it expands data collection beyond what is necessary for enhancing a user-selected video, creating privacy and tracking risk that may not be covered by the user's informed consent.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill performs network and local command execution behaviors but does not declare an explicit tool scope such as permissions or allowed-tools in a machine-enforceable form. Even though the markdown documents intended limits, the lack of formal scope increases the chance an agent can invoke broader shell or network capabilities than users expect, weakening containment and auditability.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module-level security notice asserts that cloud-side data is deleted after processing completes, but the code neither calls a deletion endpoint nor verifies retention/deletion status from the provider. This is dangerous because it can mislead users into sharing potentially sensitive videos under false assurances about third-party data handling.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_enhance.py (reported line 91)May include surrounding context.

python

def check_ffmpeg() -> bool:
    """Check if ffmpeg is installed"""
    try:
        subprocess.run(['ffprobe', '-version'], capture_output=True, check=True, timeout=5)
        return True
    except (subprocess.CalledProcessError, FileNotFoundError):
        return False

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_enhance.py (reported line 110)May include surrounding context.

python

'-of', 'json',
            video_path
        ]
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        data = json.loads(result.stdout)
        
        stream = data.get('streams', [{}])[0]

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill derives a stable device identifier from system name, machine type, hostname, and MAC-derived node ID, then sends it as X-Device-Id to a third-party cloud service. For basic video enhancement this is not necessary, creates cross-session/device tracking risk, and increases privacy exposure beyond what a user would reasonably expect from uploading a video.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.