Security audit

guaikei-extract-video-text

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its advertised cloud video-to-text purpose, but it can fetch and upload overly broad URLs and local files without enough scoping or confirmation.

Install only if you are comfortable sending video content, prompts, task identifiers, filenames, and an API token to the provider's cloud service. Avoid passing sensitive local paths, private-network URLs, localhost URLs, metadata-service URLs, or untrusted redirected links; prefer explicit user-approved media files and public HTTPS video sources.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/utils/validator.js:12
Finding: Arbitrary Local File Upload Through Unrestricted File Input
Content: View full analysis
{ const fileStats = fs.statSync(filename); const totalSize = fileStats.size; let uploadedSize = 0; let settled = false; const fileStream = fs.createReadStream(filename); const uploadHeaders = Object.assign({}, headers); uploadHeaders["Content-Length"] = String(totalSize); if (!uploadHeaders["Content-Type"]) { uploadHeaders["Content-Type"] = "application/octet-stream"; } const options = { host: url.hostname, path: url.pathname + url.search, method: "PUT", headers: uploadHeaders, }; const req = https.request( { ...options, timeout: constants.REQUEST_TIMEOUT }, (res) => { ``` ### Technical Analysis The local-file validator only checks whether the supplied path refers to a r ...[truncated 1864 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/utils/validator.js:3
Finding: Server-Side Request Forgery and Internal-Network Data Relay
Content: View full analysis
{ this.__response = response; if (!this.__isResumed) { this.__total = parseInt(response.headers["content-length"]) || null; this.__resetStats(); } if (this.__isResumed && response.statusCode === 200) { this.__isResumed = false; this.__total = parseInt(response.headers["content-length"]) || null; this.__resetStats(); } if (this.__isRequireRedirect(response)) { this.__redirectCount++; if (this.__redirectCount > this.__opts.maxRedirects) { const err = new Error("Too many redirects"); this.__setState(this.__states.FAILED); this.emit("error", err); return reject(err); } const redirectedURL = /^https?:\/\//.test(response.headers.location) ? response.headers.location : new URL(response.headers.location, this.url).href; this.__isRedirected = true; this.__initProtocol(redirectedURL); this.emit("redirected", redirectedURL, this.url); return this.__start(); } ``` ```js // scripts/video2text/index.js:96-105 if (validator.isUrl(file)) { const filepath = utils.downloadPath(); try { await fs.promises.mkdir(filepath, { recursive: true }); } catch (error) { utils.printError("临时下载目录创建失败: " + (error.message || String(error))); process.exit(1); } try { const downloadResult = await helper.download(file, filepath); ``` ### Technical Anal ...[truncated 2104 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/utils/helper.js:27
Finding: Unbounded Remote Downloads Can Exhaust Local Storage
Content: View full analysis
{ const options = { retry: { maxRetries: constants.CREATE_MAX_ATTEMPTS, delay: constants.RETRY_INTERVAL, }, override: { skip: true, skipSmaller: true }, }; ``` ```js // scripts/utils/download.js:514-567 __startDownload(response, resolve, reject) { let readable = response; if (!this.__isResumed) { const _fileName = this.__getFileNameFromHeaders(response.headers); this.__filePath = this.__getFilePath(_fileName); this.__fileName = this.__filePath.split(path.sep).pop(); if (fs.existsSync(this.__filePath)) { const downloadedSize = this.__getFilesizeInBytes(this.__filePath); const totalSize = this.__total ? this.__total : 0; if ( typeof this.__opts.override === "object" && this.__opts.override.skip && (this.__opts.override.skipSmaller || downloadedSize >= totalSize) ) { this.emit("skip", { totalSize: this.__total, fileName: this.__fileName, filePath: this.__filePath, downloadedSize: downloadedSize, }); this.__setState(this.__states.SKIPPED); return resolve(true); } } this.__fileStream = fs.createWriteStream(this.__filePath, {}); } else { this.__fileStream = fs.createWriteStream(this.__filePath, { flags: "a" }); } this.emit("download", { fileName: this.__fileName, filePath: this.__filePath, totalSize: this.__total, isResumed: this.__isResumed, downloadedSize: this.__downloaded, }); this.__retryCount = 0; this.__isResumed = false; this.__isRedirected = false; this.__setState(this. ...[truncated 2148 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill accepts arbitrary remote URLs and states it will download them to a local tmp directory, with redirect/retry/range handling. Without an explicit allowlist, scheme restrictions, and SSRF/local-address protections, this can enable fetching attacker-controlled resources or internal network endpoints, creating server-side request forgery and risky file-handling exposure. In this skill context, remote video ingestion is expected, which makes the behavior less suspicious, but it is still dangerous if input URLs are insufficiently constrained.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill accepts arbitrary remote URLs and states it will download them to a local tmp directory, with redirect/retry/range handling. Without an explicit allowlist, scheme restrictions, and SSRF/local-address protections, this can enable fetching attacker-controlled resources or internal network endpoints, creating server-side request forgery and risky file-handling exposure. In this skill context, remote video ingestion is expected, which makes the behavior less suspicious, but it is still dangerous if input URLs are insufficiently constrained.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill accepts arbitrary remote URLs and states it will download them to a local tmp directory, with redirect/retry/range handling. Without an explicit allowlist, scheme restrictions, and SSRF/local-address protections, this can enable fetching attacker-controlled resources or internal network endpoints, creating server-side request forgery and risky file-handling exposure. In this skill context, remote video ingestion is expected, which makes the behavior less suspicious, but it is still dangerous if input URLs are insufficiently constrained.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill accepts arbitrary remote URLs and states it will download them to a local tmp directory, with redirect/retry/range handling. Without an explicit allowlist, scheme restrictions, and SSRF/local-address protections, this can enable fetching attacker-controlled resources or internal network endpoints, creating server-side request forgery and risky file-handling exposure. In this skill context, remote video ingestion is expected, which makes the behavior less suspicious, but it is still dangerous if input URLs are insufficiently constrained.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Although the README mentions cloud processing and privacy claims elsewhere, it does not clearly warn at the point of use that supplied video files and links are sent to a remote cloud service for processing. This can mislead users into believing processing is local or low-risk, increasing the chance of exposing sensitive media, transcripts, or embedded personal data to an external provider without informed consent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README defines very broad natural-language activation rules such as any request containing a video link, local file path, or summary/rewrite intent. In an agent setting, this can cause over-triggering on ordinary conversation and may lead to unintended upload and processing of user-provided videos or URLs by a remote service without sufficiently explicit user confirmation.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · README.md (reported line 99)May include surrounding context.
md
4. 同时传入文件路径与任务ID，优先执行 `--id`，忽略 `--file` 5. 无自定义 prompt 时，默认完整转录视频全部文字 | 用户自然语言指令 | 自动生成命令 | | -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 视频提取 https://example.com/video.mp4 中的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 把本地 /path/to/your/video.mp4 改成小红书风格的文案 | `node scripts/video2text/index.js --file "/path/to/your/video.mp4" --prompt "改写成小红书风格的文案"` |

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.
md
## 6. 🧠 自然语言 → 命令映射（AI 执行参考） | 用户自然语言指令 | 生成的命令 | | ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 提取 https://example.com/video.mp4 里的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This manifest description lists many generic scenarios and capabilities such as transcription, summaries, rewriting, meeting minutes, and content creation, but does not define what specific user requests should invoke the skill versus ordinary conversation. In a manifest file, that broad natural-language scope can create ambiguous activation and unintended invocation overlap with common requests.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The user-facing description is entirely in Chinese and explicitly references generating '中英翻译' as one of the outputs, but it does not indicate that users may choose their preferred interaction language or output locale. This can be a natural-language locale policy issue if the skill defaults to a specific language without opt-in or documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file contains user-visible error messages and operation labels exclusively in Chinese, such as parameter validation errors and request descriptors. This can violate language/locale policy when the skill forces a specific language without offering user opt-in or documenting a justified locale restriction.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This helper constructs an HTTPS POST request, serializes arbitrary input data, and sends it along with a TOKEN header to a remote host. The file contains no confirmation prompt, user-facing warning, or explanatory comment disclosing that user/system data and credentials may be transmitted off-host.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: All user-visible warning and status strings in this flow are written in Chinese, including operational guidance and promotional text, with no indication that the user can select another language. This can violate language/locale policy where skills must not impose a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The comment at L007-L009 makes strong operational promises: no leakage, no secondary use, and automatic deletion after processing. However, the implementation in this file only performs an HTTPS PUT to a provided presigned URL and contains no logic for deletion, retention control, or usage restriction enforcement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The banner text is hardcoded in Chinese, which indicates the skill presents itself in a specific language without any visible opt-in or locale selection. Under the policy, language-specific behavior should either offer user choice or clearly document a justified locale restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: User-facing descriptions, help text, and examples are presented only in Chinese, which imposes a specific language on users without any opt-in or alternative. The policy explicitly calls out language or locale constraints as violations unless the skill offers a choice or clearly documents a justified regional limitation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: This code sends user-supplied filename data and an API token to a remote endpoint to obtain upload credentials, but there is no confirmation prompt or user-facing disclosure in the file itself. Similar undisclosed transmissions continue in later functions for uploaded video URLs and prompts, which may affect user privacy if callers are unaware that data is sent to an external API.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This file embeds user-facing natural-language strings in Chinese, beginning with the top-level description and continuing throughout errors and help output. Under the policy, forcing a specific language without user opt-in can be a locale-policy violation unless the constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The thrown errors, warnings, usage text, and examples are all presented only in Chinese, with no indication that users can choose another language. That creates a natural-language policy concern because the skill appears to enforce a single locale for all users.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code includes all user-visible descriptions and runtime messages in Chinese, including the docstring and printed informational/error text. Under the policy, forcing a specific language without offering user choice or documenting a justified locale restriction is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Multiple user-visible error messages are written only in Chinese, including operational guidance and support contact text. That forces a specific language/locale on users without any opt-in or explanation, which fits the language-policy violation category.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This JavaScript file uses Chinese-only natural-language documentation and runtime messages throughout, including the function docstring and error/progress output. Under the language/locale policy rule, forcing a specific language without user opt-in can be a policy violation when no alternative locale or choice is provided.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.