Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly does what it claims, but it can fetch arbitrary URLs and upload the resulting content to a server-chosen HTTPS destination broader than its documentation discloses.
Review before installing. Only use this skill with media you are willing to send to a third-party cloud service, avoid attacker-supplied or internal/private URLs, and prefer local transcription for confidential content until URL allowlisting, private-network blocking, download limits, and upload-host disclosure are added.
scripts/utils/validator.js:3Unrestricted URL Fetching Enables Internal Resource Access and Exfiltration
scripts/utils/download.js:32Missing Download Size and Timeout Limits Permit Resource Exhaustion
scripts/utils/upload.js:11Server-Controlled Upload Destination Is Not Restricted to Trusted Storage Hosts
A skill that mainly performs token checks, pause controls, or promotional messaging while claiming to transcribe and analyze video misleads users and orchestration systems about both utility and risk. That can cause improper routing of user data, wasted trust, and unnecessary exposure of secrets such as API tokens without delivering the declared function.
A skill that mainly performs token checks, pause controls, or promotional messaging while claiming to transcribe and analyze video misleads users and orchestration systems about both utility and risk. That can cause improper routing of user data, wasted trust, and unnecessary exposure of secrets such as API tokens without delivering the declared function.
A skill that mainly performs token checks, pause controls, or promotional messaging while claiming to transcribe and analyze video misleads users and orchestration systems about both utility and risk. That can cause improper routing of user data, wasted trust, and unnecessary exposure of secrets such as API tokens without delivering the declared function.
A skill that mainly performs token checks, pause controls, or promotional messaging while claiming to transcribe and analyze video misleads users and orchestration systems about both utility and risk. That can cause improper routing of user data, wasted trust, and unnecessary exposure of secrets such as API tokens without delivering the declared function.
The downloader copies URL-embedded username/password into the HTTP auth field, causing credentials present in a supplied URL to be transmitted automatically. In this skill context, URLs may come from user-provided third-party video links, so an attacker could induce authenticated requests to internal or external services, leaking secrets or accessing resources with unintended credentials.
The README defines broad natural-language-to-command conversion rules such as treating any detected link or file path as a --file argument and any analysis request as --prompt, without clear trigger boundaries, confirmation steps, or input validation guidance. In an agent setting, this can cause unintended execution against attacker-supplied URLs, reuse of prior task IDs, or overly permissive prompt forwarding, which may lead to unintended data processing or SSRF-like fetch behavior depending on the implementation.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
4. 同时传入文件路径与任务ID，优先执行 `--id`，忽略 `--file`
5. 无自定义 prompt 时，默认完整转录视频全部文字
| 用户自然语言指令 | 自动生成命令 |
| -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
| 视频提取 https://example.com/video.mp4 中的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` |
| 把本地 /path/to/your/video.mp4 改成小红书风格的文案 | `node scripts/video2text/index.js --file "/path/to/your/video.mp4" --prompt "改写成小红书风格的文案"` |
The skill declares access to the sensitive environment variable GUAIKEI_API_TOKEN in metadata but does not define explicit tool scope such as permissions or allowed-tools. That weakens least-privilege guarantees and makes it harder for the host to constrain what the skill may access, especially given the skill also claims networked cloud processing of user-supplied media.
The trigger examples are broad enough to overlap with common summarization or content-analysis requests, which can cause an agent to invoke this external, token-bearing, networked skill when a safer local capability would suffice. In context, that increases the chance of unnecessary third-party sharing of user-provided links, files, or content.
The guidance tells the agent to prioritize this skill for wide intent categories such as summarization, rewriting, and analysis, without requiring strong evidence that the input is actually a supported video task. That expands the skill's effective authority and can route unrelated user content to a third-party service under an overly permissive invocation policy.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
当用户用自然语言下达指令时，按以下映射生成命令，保证识别与执行一致：
| 用户自然语言指令 | 生成的命令 |
| ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
| 提取 https://example.com/video.mp4 里的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` |
| 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |
This file's docstrings, validation errors, and operation labels are entirely in Chinese, which indicates a fixed language choice in user-visible text. Under the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy violation.
This utility emits all user-facing strings in Chinese, including error messages and help text. That hard-codes a single language for all users and matches the policy category for language/locale constraints without an explicit opt-in or documented region-specific justification.
This JavaScript file contains natural-language comments and user-facing log/error strings only in Chinese, with no indication that the skill is region-specific or that users can opt into the locale. Under the policy, forcing a specific language without user choice or justification is a natural-language policy violation.
This utility performs outbound HTTP/HTTPS requests and follows redirects, potentially sending request headers and URL-derived data to multiple remote endpoints, but the code does not provide any visible warning or explanatory comment about that behavior. Because network transmission is safety-relevant, especially when headers or credentials may be included, some disclosure is expected.
This code creates and appends to files on disk, and elsewhere in the class it also deletes files on stop/failure, but there is no confirmation prompt, print/log statement, or explanatory comment/docstring warning users about these filesystem side effects. For a reusable downloader utility, these are safety-relevant operations that can affect user data and should be disclosed clearly.
Multiple thrown error messages are written in Chinese, which forces a specific language for user-visible output. The file does not offer localization, user language selection, or any justification that the skill is intentionally limited to a Chinese-speaking or region-specific audience.
Authentication, timeout, and network failure messages are user-facing and all hard-coded in Chinese. This enforces a specific language in operational error handling without giving users a choice or documenting a locale restriction.
This code sends arbitrary JSON data over HTTPS and includes a TOKEN header, which means user or system data may be transmitted to a remote service. Within this file there is no confirmation prompt, user-facing notice, or explicit warning comment/docstring describing that outbound network transmission and credential use occur.
This code emits all warning and informational messages exclusively in Chinese, with no indication that the skill is region-specific or that the user can choose a different language. That creates a natural-language policy concern because the skill imposes a specific language on users without opt-in.
The entire skill documentation and usage guidance are presented only in Chinese, and no language or locale choice is offered to users. This can constitute a language policy violation when users are not given an explicit opt-in or alternative locale.
The natural-language comment uses Chinese only ("下载文件") with no indication that the skill is region-specific or that users can choose their preferred language. This can violate a language/locale policy when skills are expected to be language-neutral or offer opt-in.
The error message explicitly references GUAIKEI_API_TOKEN, indicating the skill depends on a sensitive token credential. This file lacks any nearby user-facing warning or explanatory comment that the skill uses such a credential to authenticate outbound requests.
The banner string is hard-coded in Chinese, which indicates a fixed language experience rather than offering the user a locale or language choice. The policy explicitly calls for flagging language or locale constraints when they are forced without user opt-in or documented justification.
No suspicious patterns detected.