Emergence Video Producer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:52 AM UTC
• Version: 0.1.1

Overview

This video-production skill is mostly coherent, but it needs review because its audio helper unnecessarily loads local .env secrets and passes them to a network-capable text-to-speech subprocess.

Install only in a project workspace where generated files can be overwritten safely. Avoid running the audio helper in directories with sensitive .env files, or remove dotenv loading and run TTS with a minimal environment. Treat narration text, slide content, target URLs, and template background image fetches as data that may be sent to external services.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_audio.py:4

Finding

Unnecessary Exposure of Environment Secrets to a Network-Capable TTS Subprocess

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill describes shell and environment-dependent execution (webreel, ffmpeg, TTS tooling, cloud VM/headless operation) but does not declare any tool scope or allowed-tools boundary. This increases the chance an agent will invoke broad shell capabilities without explicit restriction, which can lead to unintended command execution, file modification, or access beyond what the user expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill advertises narration via DashScope/Edge-TTS but does not warn that script content, slide text, or other user-provided material may be sent to third-party services for synthesis. In a video-production context, this can expose confidential product details, unreleased features, or proprietary academic content to external providers without informed consent.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/assemble_video.py (reported line 24)May include surrounding context.

python

"ffprobe", "-v", "error", "-show_entries", "format=duration",
        "-of", "default=noprint_wrappers=1:nokey=1", audio_path
    ]
    result = subprocess.run(cmd, capture_output=True, text=True, check=True)
    return float(result.stdout.strip())

def assemble_mp4(frame_dir, audio_path, output_path, fps):

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code defaults to the zh-CN-XiaoxiaoNeural voice in both the function signature and CLI argument, which imposes a specific language/locale choice on users unless they override it. This is a natural-language policy concern because the skill does not document a user choice prompt or a justification for restricting output to Chinese.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/assemble_video.py (reported line 36)May include surrounding context.

python

"--write-media", output_file,
        "--voice", voice
    ]
    subprocess.run(cmd, check=True)
    print(f"✓ Audio saved to {output_file}")

def main():

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate_audio.py (reported line 17)May include surrounding context.

python

"--write-media", output_file,
        "--voice", voice
    ]
    subprocess.run(cmd, check=True)
    print(f"✓ Audio saved to {output_file}")

def main():

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The workflow automatically generates artifacts such as storyboard.md, webreel.config.json, slides.md, narration outputs, and final media, but does not explicitly warn that existing files may be created or overwritten. In practice this can cause accidental loss of local work products or confusion about which generated artifacts are safe to keep, publish, or replace.

Content

No source excerpt is available for this finding.