Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to do what it says: it sends user-selected videos, audio, links, and prompts to a GuaiKei cloud service for transcription and content generation.
Install only if you are comfortable using a paid third-party cloud service for the selected videos/audio and prompts. Avoid passing private, internal, authenticated, or credential-bearing URLs unless you intend the agent to fetch and upload that content. Treat retention and deletion promises as service-provider policy claims, since the local skill code cannot prove server-side deletion.
声明描述的是一个面向视频转写与文案生成的技能，核心能力应包括处理视频文件/链接、提取音频或字幕、调用模型生成文本与结构化输出等。而提供的代码仅是 scripts/utils/args.js，一个通用 CLI 参数解析器，不涉及视频、网络请求、模型调用、文本生成或内容分析。虽然这类工具代码可能作为整个项目的辅助模块存在，但就该代码块本身而言，其实际行为与声明用途明显不匹配，因此应判定为描述与代码行为不一致。
代码块的核心功能是一个 Downloader 类，用于从 URL 下载文件到本地目录，并管理下载状态、重试、续传和文件流。它没有任何与视频解析、音视频转文本、字幕提取、调用大模型、文本清洗、总结改写或结构化文案生成相关的实现。虽然下载器可能作为处理远程视频链接的辅助组件，但就该代码块本身而言，其实际行为与声明的主要用途明显不一致，因此应判定为描述与行为不匹配。
This code chunk does not implement the declared video transcription and content-generation behavior. Its sole purpose is to retrieve the package name from package.json using fs/path utilities and cache the result. That behavior is unrelated to the user-facing description. While utility code can be a supporting detail, the supplied chunk provides no evidence of the claimed core capabilities and instead performs a distinct metadata lookup. Therefore, the description does not accurately represent what this code chunk actually does.
声明描述的是一个视频转写与内容生成技能，但提供的代码片段只涉及 GUAIKEI_API_TOKEN 的合法性检查和控制台提示信息输出。这不是对声明核心能力的直接实现，也看不出与视频转文字、字幕提取、总结分析等功能相关的支持性逻辑。虽然 token 校验可能是某些技能的辅助模块，但就该代码片段本身而言，其实际行为与声明用途明显不一致，因此应判定为描述与行为不匹配。
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
4. 同时传入文件路径与任务ID，优先执行 `--id`，忽略 `--file`
5. 无自定义 prompt 时，默认完整转录视频全部文字
| 用户自然语言指令 | 自动生成命令 |
| -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
| 视频提取 https://example.com/video.mp4 中的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` |
| 把本地 /path/to/your/video.mp4 改成小红书风格的文案 | `node scripts/video2text/index.js --file "/path/to/your/video.mp4" --prompt "改写成小红书风格的文案"` |
The skill declares access to an environment secret (GUAIKEI_API_TOKEN) but does not define an explicit tool scope or permissions boundary. In agent environments, missing scope declarations can lead to over-broad execution privileges and make secret usage less auditable, especially when the skill also handles user-supplied URLs and local file paths.
The activation text uses broad catch-all phrases that can cause the agent to invoke this skill for many loosely related content-analysis requests. Because the skill accepts arbitrary URLs and local file paths and may transmit media to a third-party service, over-triggering increases the chance of unintended data disclosure or unnecessary secret-backed network actions.
The guidance says to prioritize this skill whenever any matching intent appears, but lacks clear exclusions or guardrails. In an autonomous agent, ambiguous priority rules can cause the skill to handle requests outside its safe scope, increasing the risk of uploading sensitive local media or fetching untrusted URLs without sufficient user intent verification.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
当用户用自然语言下达指令时，按以下映射生成命令，保证识别与执行一致：
| 用户自然语言指令 | 生成的命令 |
| ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
| 提取 https://example.com/video.mp4 里的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` |
| 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |
The manifest advertises a very broad set of triggers and use cases, spanning transcription, summarization, rewriting, translation, social-media copy generation, and multiple content workflows. In an agent ecosystem, overly broad metadata can cause the skill to be invoked outside the author's intended context, increasing the chance that sensitive user content or untrusted links/files are routed into this skill without clear user expectation.
This code sends potentially sensitive user and system data to remote API endpoints, including an API token and user-provided filename, URL, and prompt. In this file there is no confirmation prompt, user-facing warning, or disclosure that these values will be transmitted over the network.
This code presents all natural-language output, including errors and help text, exclusively in Chinese (for example at L002, L007-L012, L100-L104, and L129-L139). That forces a specific language on users without opt-in, which matches the locale-policy violation criteria.
This downloader is configured by default to delete partially downloaded files when stopped or when a download fails, and the implementation performs unlink operations without any confirmation prompt or user-facing disclosure. Because file deletion is a safety-relevant operation in a code file, it should have some visible warning such as a comment, log message, or explicit prompt unless clearly disclosed elsewhere.
This code accepts URL-embedded credentials and forwards them as options.auth, which can lead to accidental secret exposure through logs, copied URLs, redirects, or user-supplied untrusted links. In a skill that downloads arbitrary external video URLs, accepting credential-bearing URLs increases the chance of mishandling secrets and of server-side requests being made to internal or authenticated resources.
This code emits user-facing error strings exclusively in Chinese, including validation and authentication failures. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly documented and justified, which is not present in this file.
The skill emits all warning and status text in Chinese in multiple string literals, with no indication that the user can choose another language or that the skill is intended only for a Chinese-speaking or region-specific context. This creates a natural-language policy issue because it imposes a specific language on users without opt-in or documented justification.
The comment makes a privacy and data-handling guarantee that is not enforced anywhere in this code path: the function uploads user video content to remote object storage but does not implement deletion, retention controls, or any verification that the storage backend will purge the object after processing. In a skill specifically designed to process potentially sensitive videos from local files and social platforms, this gap can mislead users and operators into assuming protections exist when they do not, increasing the risk of unintended retention, privacy violations, and compliance issues.
The manifest description and examples are entirely Chinese and frame outputs around Chinese platforms and Chinese content styles, but do not state whether users may interact in other languages or choose output locale. This can be a language/locale policy issue when a skill implicitly constrains usage without opt-in.
The natural-language metadata, including the primary description and author-facing text, is presented only in Chinese, but the manifest does not state that the skill is China/Chinese-specific or offer language choice. This can violate language/locale policy expectations when a skill implicitly assumes one language for all users without opt-in or documented scope.
The code performs outbound network requests and may send request bodies, headers, or URL-embedded credentials, but there is no visible print/log/comment warning users that data will be transmitted to remote hosts. For code files, network operations that may transmit user or system data should include some form of disclosure unless the warning is documented elsewhere or clearly part of the stated skill purpose.
The banner text is hard-coded in Chinese, which imposes a specific language on users. The policy for natural-language behavior says to flag language or locale constraints when the skill does not offer a user choice or clearly document a justified locale restriction.