Security audit

gotitvideo

Security checks for vulnerabilities and agentic risk

Overview

The skill largely matches its video-to-text purpose, but needs Review because it can fetch arbitrary URLs and upload media or fetched content to third-party services with incomplete and contradictory disclosure.

Install only if you are comfortable sending selected videos, prompts, task IDs, the API token, and some file metadata to the provider. Do not use it on confidential, regulated, copyrighted, internal-network, localhost, metadata-service, or access-restricted media unless you have approval and understand the provider's retention policy.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/utils/validator.js:3
Finding: Arbitrary URL Downloads Enable Server-Side Request Forgery
Content: View full analysis
this.__opts.maxRedirects) { const err = new Error("Too many redirects"); this.__setState(this.__states.FAILED); this.emit("error", err); return reject(err); } const redirectedURL = /^https?:\/\//.test(response.headers.location) ? response.headers.location : new URL(response.headers.location, this.url).href; this.__isRedirected = true; this.__initProtocol(redirectedURL); ``` ### Technical Analysis URL validation only verifies that the supplied value uses HTTP or HTTPS. It does not resolve and inspect the destination address or reject loopback, private, link-local, unspecified, multicast, IPv6-local, or cloud metadata addresses. The downloader also follows HTTP redirects without applying destination restrictions to each redirected URL. Consequently, a public URL can redirect to an otherwise internal destination. DNS rebinding may provide another bypass if validation is added only before DNS ...[truncated 1765 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/api/video.js:19
Finding: Full Local Filesystem Path Is Disclosed to the Remote API
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (31)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documented behavior includes remote download and local file writes, but the high-level description presents the skill mainly as a content-cleanup/transcription tool. When destructive or broader I/O behavior is under-disclosed, users and orchestration systems may grant trust inappropriate for a component that can retrieve and persist untrusted data.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documented behavior includes remote download and local file writes, but the high-level description presents the skill mainly as a content-cleanup/transcription tool. When destructive or broader I/O behavior is under-disclosed, users and orchestration systems may grant trust inappropriate for a component that can retrieve and persist untrusted data.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented behavior includes remote download and local file writes, but the high-level description presents the skill mainly as a content-cleanup/transcription tool. When destructive or broader I/O behavior is under-disclosed, users and orchestration systems may grant trust inappropriate for a component that can retrieve and persist untrusted data.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented behavior includes remote download and local file writes, but the high-level description presents the skill mainly as a content-cleanup/transcription tool. When destructive or broader I/O behavior is under-disclosed, users and orchestration systems may grant trust inappropriate for a component that can retrieve and persist untrusted data.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented behavior includes remote download and local file writes, but the high-level description presents the skill mainly as a content-cleanup/transcription tool. When destructive or broader I/O behavior is under-disclosed, users and orchestration systems may grant trust inappropriate for a component that can retrieve and persist untrusted data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill promotes uploading local videos and submitting third-party video links to a cloud processing service, but the usage guidance does not place a prominent, explicit warning at the point of invocation that data will leave the local environment. In practice, users may provide sensitive meeting recordings, interviews, or internal course content without realizing they are being transmitted to an external service.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README defines very broad natural-language-to-command conversion rules, which can cause the skill to activate on loosely related user requests and automatically construct commands that fetch or process external/local video inputs. In an agent setting, unclear activation scope increases the chance of unintended data handling or tool invocation without sufficiently explicit user intent.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · README.md (reported line 99)May include surrounding context.
md
4. 同时传入文件路径与任务ID，优先执行 `--id`，忽略 `--file` 5. 无自定义 prompt 时，默认完整转录视频全部文字 | 用户自然语言指令 | 自动生成命令 | | -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 视频提取 https://example.com/video.mp4 中的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 把本地 /path/to/your/video.mp4 改成小红书风格的文案 | `node scripts/video2text/index.js --file "/path/to/your/video.mp4" --prompt "改写成小红书风格的文案"` |

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares access to environment secrets via GUAIKEI_API_TOKEN but does not define an explicit tool scope such as permissions or allowed-tools. In an agent environment, missing scope boundaries increases the chance that the skill is invoked with broader capabilities than necessary and makes review of secret exposure harder.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill description uses very broad activation triggers spanning transcription, summarization, content analysis, copywriting, and more. Over-broad trigger criteria increase the chance of accidental invocation on unrelated user requests, causing unintended upload of local files or remote URLs to a third-party service.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger guidance enumerates many synonymous phrases and content-analysis tasks without strong scope limits, making this skill easy to auto-select for ambiguous requests. In context, that matters because invocation may cause network fetches, cloud upload, and processing of user media by a third party.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trust section states the skill only communicates with guaikei.com, but other sections say it first downloads arbitrary public video URLs to a temp directory. Contradictory trust claims are dangerous because they hide the real attack surface: outbound requests to attacker-controlled servers and local handling of untrusted files.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill promises neutral error handling without marketing or contact details, yet elsewhere embeds website and WeChat contact information in setup and support guidance. This inconsistency is a social-engineering risk because users may be conditioned to treat promotional or contact-bearing error flows as legitimate and share sensitive operational details through unofficial channels.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This JavaScript code initiates HTTP/HTTPS requests, writes downloaded content to disk, and can delete files on stop or failure, but it only emits internal events and contains no confirmation prompt, user-facing log/print, or explanatory comments warning about these side effects. For a reusable utility, these are safety-relevant operations that are not disclosed within the code file itself.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This JavaScript file contains natural-language comment and status/error messages exclusively in Chinese, such as the function comment and multiple inlineLog messages. Under the policy, forcing a specific language without user opt-in or a documented regional justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This code emits user-facing error text in Chinese, which imposes a specific language on users without any opt-in or indication that the skill is intended only for a Chinese-speaking or region-specific environment. The same pattern appears throughout the file, making this a natural-language locale policy issue rather than a functional bug.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill emits all user-facing warning and status text in Chinese, including promotional and operational messages, with no indication that the user can choose another language. This is a natural-language locale policy concern because it imposes a specific language on all users without opt-in or documented justification.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The code-level behavior does not enforce the privacy and deletion guarantees stated in the comment: it only uploads the file to a presigned URL and returns. In a skill that handles user videos and transcription inputs, this mismatch can mislead users and integrators into believing retention and usage controls exist when they are not implemented or verified, creating privacy, compliance, and trust risks if uploaded content is retained or reused by the backend or storage provider.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill processes local video files and public URLs by sending content to a third-party cloud service, but the trigger/description does not prominently warn users that their media and potentially sensitive spoken content leave the local environment. This creates a privacy and data-handling risk because users may submit confidential meetings, interviews, or internal training videos without informed consent or awareness of third-party processing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation encourages users to download login-, membership-, or otherwise access-restricted videos and then upload them locally, without warning about copyright, terms-of-service, confidentiality, or privacy implications. This can facilitate unauthorized redistribution or re-processing of protected content and expose both the user and operator to legal and privacy risks.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: L122 明确写到“错误提示中性，不夹带营销文案、联系方式或官网链接”，但同一文档在 L103、L268 以及 L290-L294 又反复强调官网和微信联系方式，体现出意图层面的自我矛盾。虽然这不证明运行时代码一定会在报错时输出营销内容，但文档本身对预期行为给出了互相冲突的指引。
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: L146-L147 先给出决策顺序，暗示有新视频时应使用 --file，但 L149 明确说“链接和上次任务同时给了？优先听 --id”，L240 也再次规定“以 --id 为准”。这是直接影响调用意图的文档冲突：同样输入条件下，说明文档给出了两套不同决策。
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.
md
## 7. 🗣️ 自然语言 → 命令（照这张表转） | 用户说的话 | 就执行这条命令 | | ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 提取 https://example.com/video.mp4 里的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · video2text-ai-1.0.1/SKILL.md (reported line 156)May include surrounding context.
md
## 7. 🗣️ 自然语言 → 命令（照这张表转） | 用户说的话 | 就执行这条命令 | | ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 提取 https://example.com/video.mp4 里的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The package description is entirely in Chinese and presents the skill's functionality only in that language. Under the policy, language constraints should either offer user choice or be clearly documented as a justified locale-specific limitation, which is not present here.
Content: No source excerpt is available for this finding.