Security audit

guaikei视频速记

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to do what it says, but it can fetch arbitrary URLs, upload media to a third-party service, and reuse prior task context with limited scoping controls.

Install only if you are comfortable sending selected media, URLs, prompts, task IDs, and your service token to guaikei.com and its presigned upload destination. Avoid using it on confidential meetings, regulated data, private-network URLs, localhost/internal links, or very large files unless you have approved that exposure and cost.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (26)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the implementation can download arbitrary URLs to local storage, follow redirects, retry, resume partial transfers, and manage local files, that materially exceeds a simple transcription wrapper and introduces SSRF, untrusted content retrieval, disk-consumption, and unsafe file-handling risks. The danger is increased here because the skill explicitly accepts arbitrary public video links from many platforms and encourages automatic command generation from user input.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the implementation can download arbitrary URLs to local storage, follow redirects, retry, resume partial transfers, and manage local files, that materially exceeds a simple transcription wrapper and introduces SSRF, untrusted content retrieval, disk-consumption, and unsafe file-handling risks. The danger is increased here because the skill explicitly accepts arbitrary public video links from many platforms and encourages automatic command generation from user input.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the implementation can download arbitrary URLs to local storage, follow redirects, retry, resume partial transfers, and manage local files, that materially exceeds a simple transcription wrapper and introduces SSRF, untrusted content retrieval, disk-consumption, and unsafe file-handling risks. The danger is increased here because the skill explicitly accepts arbitrary public video links from many platforms and encourages automatic command generation from user input.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the implementation can download arbitrary URLs to local storage, follow redirects, retry, resume partial transfers, and manage local files, that materially exceeds a simple transcription wrapper and introduces SSRF, untrusted content retrieval, disk-consumption, and unsafe file-handling risks. The danger is increased here because the skill explicitly accepts arbitrary public video links from many platforms and encourages automatic command generation from user input.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill markets 'cloud processing' and 'link direct parsing' but does not clearly and prominently warn at the point of use that local video files and supplied URLs are transmitted to a third-party remote service for analysis. For a tool commonly used on meetings, interviews, courses, and business content, that omission can lead users to disclose sensitive or regulated media without informed consent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README defines very broad natural-language trigger rules and automatic command translation, which can cause the skill to activate on loosely related user requests and automatically transform user text into execution parameters. In a skill that accepts file paths, remote URLs, prompts, and reusable task IDs, this increases the chance of unintended remote uploads, processing of the wrong resource, or accidental reuse of prior analysis context without clear user confirmation.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · README.md (reported line 99)May include surrounding context.
md
4. 同时传入文件路径与任务ID，优先执行 `--id`，忽略 `--file` 5. 无自定义 prompt 时，默认完整转录视频全部文字 | 用户自然语言指令 | 自动生成命令 | | -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 视频提取 https://example.com/video.mp4 中的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 把本地 /path/to/your/video.mp4 改成小红书风格的文案 | `node scripts/video2text/index.js --file "/path/to/your/video.mp4" --prompt "改写成小红书风格的文案"` |

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill declares access to an environment variable (GUAIKEI_API_TOKEN) but does not define an explicit permission or allowed-tools scope. In agent environments, missing scope declarations weaken reviewability and can allow the skill to access secrets without clear user-facing authorization boundaries.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger phrases are extremely broad and cover common content-workflow requests, increasing the chance the agent invokes this skill for unrelated tasks. In context, that can cause unnecessary upload of user-provided media or links to a third-party service and over-collect sensitive content beyond user expectations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill does not present a prominent warning at activation time that provided video/audio files or URLs will be uploaded to a remote service for processing. Because media may contain confidential meetings, interviews, or unpublished content, insufficient disclosure can lead to unintended third-party exposure of sensitive data.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The guidance says to prioritize this skill across broad categories like summaries, scripts, meeting notes, and content extraction without sharply separating when remote upload is necessary. That ambiguity raises the risk of accidental invocation and data transfer to the external service for requests that could be handled locally or with safer defaults.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.
md
当用户用自然语言下达指令时，按以下映射生成命令，保证识别与执行一致： | 用户自然语言指令 | 生成的命令 | | ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 提取 https://example.com/video.mp4 里的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Docstrings and thrown error messages are written in Chinese, which imposes a specific language on users and maintainers without any opt-in or documented regional justification in this file. The policy explicitly calls out language or locale constraints as violations when they are forced without user choice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This JavaScript code sends user-supplied video URL data and optional prompt content to remote API endpoints via requestApi, but there is no confirmation prompt, visible user-facing log, or explicit disclosure in this file about that transmission. Because the operations involve sending user data to external services, they match the code-file warning criteria for safety-relevant network activity lacking disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The stop path removes the partially downloaded file when removeOnStop is enabled, and the code performs the deletion directly with fs.unlink without any visible confirmation prompt or user-facing disclosure. Because this is a destructive filesystem action in a general download utility, users may not realize stopping a download can also erase local data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: On failure, __removeFile() closes the stream and unlinks the target file when removeOnFail is enabled, but this destructive behavior is not accompanied by any visible confirmation or user-facing warning in this file. Users could lose partially downloaded content without being clearly informed that failures trigger automatic file deletion.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This code constructs and sends outbound HTTPS POST requests containing arbitrary JSON payload data and a TOKEN header. There is no confirmation prompt, user-facing warning, or explanatory comment in this file indicating that user or system data may be transmitted to a remote service.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The user-facing messages shown when the token is invalid are entirely in Chinese, and there is no indication that the skill supports other languages or that Chinese is a required locale. This creates a natural-language policy concern because the skill imposes a specific language on users without opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This file uses Chinese-only natural-language messaging in the documentation and runtime error/output strings, indicating the skill is designed to communicate in a fixed language. Under the policy, forcing a specific language without user opt-in or a documented locale-specific justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The CLI help text, flag descriptions, and user-facing examples are presented only in Chinese. This imposes a specific language on all users without any opt-in, which matches the language/locale policy violation category.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The natural-language description is entirely in Chinese and does not state that the skill is region-specific or that other language options are available. Under the language/locale policy, this can be a policy concern when a skill appears to impose a language choice without user opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains user-facing natural-language strings in Chinese, beginning with the file header comment and continuing throughout thrown errors and help output. Because the skill forces a specific language for user-visible CLI interactions without offering a locale choice or documenting a justified locale restriction, it matches the language/locale policy violation category.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The generated help text and option descriptions are shown only in Chinese, and earlier error paths also use Chinese-only messages. This is a natural-language policy issue because the implementation enforces one language without opt-in or alternative locale support.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file contains its only natural-language documentation and user-visible log/error messages in Chinese, including the function comment and printed status/error text. This can violate language/locale policy when a skill imposes a specific language without user opt-in or a documented regional justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The string literal forces a Chinese-language error and support message regardless of user locale or preference. This can violate language or locale policy when the skill does not provide opt-in or localization handling.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.