Security audit

guaikei视频里的话转文字

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its video-to-text purpose, but it needs review because it uploads videos to cloud endpoints whose scope is under-disclosed and uses promotional token-error messaging.

Review before installing if you may process confidential meetings, customer recordings, regulated content, or proprietary media. Use it only when you are comfortable sending the selected video, prompt, and API token to the provider’s cloud workflow, and ask the publisher to document the actual upload destinations, retention guarantees, and neutral error behavior more precisely.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documentation explicitly promises neutral error behavior without marketing content, yet the finding indicates token validation may emit purchase/get-token promotional messaging. Blending authentication failures with upsell or contact instructions can socially engineer operators into disclosing environment setup, trusting unaudited support channels, or bypassing normal procurement/security review.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documentation explicitly promises neutral error behavior without marketing content, yet the finding indicates token validation may emit purchase/get-token promotional messaging. Blending authentication failures with upsell or contact instructions can socially engineer operators into disclosing environment setup, trusting unaudited support channels, or bypassing normal procurement/security review.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documentation explicitly promises neutral error behavior without marketing content, yet the finding indicates token validation may emit purchase/get-token promotional messaging. Blending authentication failures with upsell or contact instructions can socially engineer operators into disclosing environment setup, trusting unaudited support channels, or bypassing normal procurement/security review.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documentation explicitly promises neutral error behavior without marketing content, yet the finding indicates token validation may emit purchase/get-token promotional messaging. Blending authentication failures with upsell or contact instructions can socially engineer operators into disclosing environment setup, trusting unaudited support channels, or bypassing normal procurement/security review.

Whitespace Padding

Medium

Category: Prompt Injection
Content: 4. 同时传入文件路径与任务ID，优先执行 `--id`，忽略 `--file` 5. 无自定义 prompt 时，默认完整转录视频全部文字 | 用户自然语言指令 | 自动生成命令 | | -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 视频提取 https://example.com/video.mp4 中的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 把本地 /path/to/your/video.mp4 改成小红书风格的文案 | `node scripts/video2text/index.js --file "/path/to/your/video.mp4" --prompt "改写成小红书风格的文案"` |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill routes user-provided local videos and external links to a cloud service, but the privacy/data-transfer warning is not surfaced prominently before use. Users may unknowingly upload sensitive meetings, interviews, or proprietary media to a third party, creating confidentiality and compliance risk in exactly the kind of content this skill is meant to process.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: At L122 the skill states that error messages should be neutral and must not include marketing copy, contact details, or website links. However, the document later provides a dedicated contact-and-business section with WeChat and homepage details (L473-L477), creating an intent-level contradiction within the skill's own documentation about how user-facing failure handling should avoid promotional content.

Whitespace Padding

Medium

Category: Prompt Injection
Content: ## 7. 🗣️ 自然语言 → 命令（照这张表转） | 用户说的话 | 就执行这条命令 | | ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 提取 https://example.com/video.mp4 里的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The manifest description advertises many broad use cases and trigger phrases without clearly scoping when the skill should or should not activate. In an agent ecosystem, this can cause over-broad invocation, leading the skill to receive unintended user data or handle requests outside its safe operating assumptions, especially since it accepts both local files and public links for cloud-side processing.

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: This JavaScript file uses Chinese-only natural-language strings in its public-facing documentation and thrown error messages, such as parameter validation errors and operation labels. Because the file does not offer a language choice or document that the skill is intentionally limited to a Chinese-language context, it presents a locale policy concern under the natural-language policy rule.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: This utility presents natural-language output exclusively in Chinese, including comments, thrown error messages, and generated help text. For a general-purpose CLI argument parser, that imposes a specific language/locale without offering user opt-in or documenting that the skill is intentionally Chinese-only.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: This code emits user-facing error strings exclusively in Chinese, including failures and credential guidance. The file does not offer any language selection or indicate that the skill is intentionally limited to a Chinese-speaking or region-specific context, which creates a language/locale policy concern.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The skill emits all warning and informational messages in Chinese, including promotional and operational notices, with no indication that the user can choose another language. This creates a natural-language locale policy issue because the file imposes a specific language on all users without opt-in or documented justification.

Natural-Language Policy Violations

Low

Confidence: 81% confidence
Finding: The manifest description is written only in Chinese and presents the skill behavior and triggers in Chinese without indicating whether users may interact in other languages. Under the policy, forcing a specific language without opt-in or a documented regional justification is a natural-language policy concern.

Intent-Code Divergence

Low

Confidence: 99% confidence
Finding: The manifest declares the skill name as `guaikei-video-speech-to-text` (L002), but the conventions section says the skill's `name`, directory, package name, and H1 should be `guaikei-video-to-doc`. This is an active contradiction in the documentation about the skill's intended identity, not merely missing detail.

Intent-Code Divergence

Low

Confidence: 99% confidence
Finding: Section 10.2 states that the manifest's `name` field for this skill is `guaikei-video-to-doc`, while the actual frontmatter at L002 uses `guaikei-video-speech-to-text`. Because this section explicitly documents the current skill's field values, it directly conflicts with the file's actual metadata.

Intent-Code Divergence

Low

Confidence: 97% confidence
Finding: The directory structure section documents the skill root as `guaikei-video-to-doc/`, which conflicts with the manifest's declared skill name `guaikei-video-speech-to-text` at L002. Since this section is presented as the required structure for this skill, it actively contradicts the metadata-defined identity.

Natural-Language Policy Violations

Low

Confidence: 80% confidence
Finding: The natural-language description and several metadata fields are presented in Chinese only, with no indication that users may choose their preferred language or locale. This can be a language policy issue if the skill experience effectively forces a specific language without opt-in.

Natural-Language Policy Violations

Low

Confidence: 92% confidence
Finding: The banner string is entirely in Chinese and presents the tool identity in a single fixed language. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation when no alternative locale or choice mechanism is provided in the file.

Static analysis

No suspicious patterns detected.