Security audit

guaikei全网视频转写

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed video/audio transcription command that uploads user-selected media to an external paid service, with no evidence of hidden execution or unrelated data access.

Install only if you are comfortable sending the selected video/audio, prompts, and task metadata to GuaiKei's external service and using its paid token model. Avoid confidential media unless the vendor's privacy and retention terms meet your requirements, and be aware that temporary downloaded files and the last task ID may remain in the skill's tmp directory until cleanup runs.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (21)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 代码片段与“视频转文字/视频总结/文案生成”无直接功能对应。该代码未体现任何视频读取、链接处理、音视频转写、模型调用、文本清洗、总结改写或文案生成能力，而是一个独立的通用命令行参数解析模块。虽然这类工具可能作为底层辅助组件被其他视频处理脚本调用，但就该代码片段本身而言，其实际行为与声明用途存在明显不一致，主功能也不同。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的核心能力应围绕视频内容理解与文本生成，例如音视频转写、字幕提取、总结改写、翻译和文案生成。但提供的代码块完全没有任何音视频解析、语音识别、大模型调用、文本清洗、总结或文案生成逻辑。相反，它实现了一个独立的下载器组件：向 URL 发起 HTTP/HTTPS 请求，将响应流写入本地文件，支持暂停、恢复、停止、重试、重定向和断点续传。这可能是处理远程视频链接时的配套基础设施，但就该代码块本身而言，其实际行为与声明的主要用途明显不一致，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: 从该代码片段看，实际行为是下载远程文件并输出下载进度，属于底层文件获取工具，而不是视频转写或文案生成逻辑。虽然“支持平台视频链接”可能需要下载作为配套步骤，但当前片段没有任何音视频解析、字幕提取、语音识别、文本清洗或大模型调用实现。作为辅助实现细节，下载本身可以被视为支撑能力；但就该片段单独而言，其行为与声明的核心用途存在明显差距，且展现了一个未在描述中直接说明的通用下载能力，因此应判定为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个完整的视频转文字与文案生成技能，但提供的代码片段仅是一个辅助工具：读取当前项目 package.json 中的 name 字段并缓存返回。该行为既不涉及视频文件或视频链接处理，也不涉及模型调用、转写、内容清洗或文案生成。虽然这可能是技能内部的支持性代码，但就“所提供代码片段实际做了什么”而言，它与声明用途明显不一致，属于与主功能无关的实现片段。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个完整的视频转写与文案生成技能，但提供的代码片段实际只是辅助性的 token 校验逻辑，而且还包含明显与声明无关的推广信息输出。就该代码片段本身而言，其主要行为与声明的核心用途不一致。虽然 token 校验可能作为某些技能的配套实现细节存在，但当前片段没有体现任何与视频分析/转写相关的功能，反而展示了未声明的营销输出，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · README.md (reported line 99)May include surrounding context.
md
4. 同时传入文件路径与任务ID，优先执行 `--id`，忽略 `--file` 5. 无自定义 prompt 时，默认完整转录视频全部文字 | 用户自然语言指令 | 自动生成命令 | | -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 视频提取 https://example.com/video.mp4 中的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 把本地 /path/to/your/video.mp4 改成小红书风格的文案 | `node scripts/video2text/index.js --file "/path/to/your/video.mp4" --prompt "改写成小红书风格的文案"` |

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: L003 将“会议纪要”“课程拆解”“直播复盘”“采访整理”等宽泛需求直接列为触发条件，这些表述在日常工作对话中非常常见，且未明确限定必须与视频/音频转写任务相关。缺少负例或排除条件时，代理可能在用户只是泛泛提到这些任务时错误调用该技能。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: L003 的技能描述全文以中文固定定义触发需求和输出场景，且未说明是否支持按用户偏好切换界面语言或默认语言。按规则，若技能在自然语言层面强制特定语言而无用户选择或明确区域性正当说明，应视为语言/locale 策略问题。
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: L071-L077 说明“出现以下任意意图时优先调用本技能”，其中“整理成会议纪要”“课程拆解”“探店脚本撰写”等意图并不天然要求视频转写，容易与一般写作、总结类请求重叠。虽然文档整体描述了视频场景，但该触发段落本身未明确要求必须存在视频/音频输入或历史任务上下文。
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.
md
当用户用自然语言下达指令时，按以下映射生成命令，保证识别与执行一致： | 用户自然语言指令 | 生成的命令 | | ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 提取 https://example.com/video.mp4 里的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest describes a very broad set of activation scenarios and content-generation tasks without clear boundaries, exclusions, or user-confirmation requirements. In an agent ecosystem, this can cause over-invocation on loosely related prompts, leading to unnecessary processing of user-provided files/links and increased risk of unintended data exposure to external transcription/model services.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The manifest description is written entirely in Chinese and presents the skill's behavior and outputs in that locale without any indication that users may select another language. Under the policy, language or locale constraints should be opt-in or clearly justified; this file does not document such a choice or limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file’s natural-language strings and developer-facing documentation are entirely in Chinese, including comments and thrown error messages. Under the stated policy, forcing a specific language without user opt-in or a documented regional justification is a locale-policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code forces Chinese for user-facing errors, warnings, and help output across the parser, which is a natural-language locale constraint. The file does not provide any opt-in, fallback, or justification that the tool is intentionally Chinese-only or region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code file contains user-facing log/error messages and documentation exclusively in Chinese, which can impose a language/locale constraint on users or operators. The file does not indicate that the skill is China-specific or provide any opt-in/alternative language behavior, so it may violate language-choice policy requirements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This JavaScript file contains natural-language strings and comments such as "下载文件", "下载完成", and other status/error messages only in Chinese. Per the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The string literal on L034 is entirely in Chinese and includes a locale-specific support instruction, which imposes a specific language on users without offering an alternative. This matches the policy category for language or locale constraints that are not optional or explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The user-facing strings are entirely in Chinese and there is no indication that the skill supports other languages, requests user opt-in, or is limited to a China-specific context. This creates a natural-language policy concern because the skill imposes a specific language/locale on users by default.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The README includes a natural-language example command, "全文翻译成英文", which hard-codes output to English. This can conflict with language/locale choice expectations because it presents a fixed language outcome without mentioning user selection or opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The banner string is presented only in Chinese, which indicates a fixed language choice in user-facing output. Under the policy rules, forcing a specific language without user opt-in or a documented justification is a natural-language policy issue.
Content: No source excerpt is available for this finding.