Security audit

guaikei视频字幕提取转文字

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its video-to-text purpose, but it under-discloses how broadly it can fetch and upload user videos through the network.

Review before installing. Use this only if you are comfortable sending the selected video, prompt, task ID, and API token to GuaiKei's cloud workflow, and avoid sensitive meeting, customer, legal, medical, or proprietary recordings unless you have approval. Treat public-link processing as a broad downloader: provide only trusted public video URLs, and remember temporary files and the last task ID may remain locally for up to 24 hours.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (22)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is presented as a narrowly scoped video transcription tool, but the analysis indicates it can download arbitrary remote files over HTTP/HTTPS and store them locally. That broadens the trust boundary substantially and can enable SSRF-like fetching of attacker-controlled content, unexpected local storage of untrusted files, and abuse as a generic downloader under a misleading description.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is presented as a narrowly scoped video transcription tool, but the analysis indicates it can download arbitrary remote files over HTTP/HTTPS and store them locally. That broadens the trust boundary substantially and can enable SSRF-like fetching of attacker-controlled content, unexpected local storage of untrusted files, and abuse as a generic downloader under a misleading description.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is presented as a narrowly scoped video transcription tool, but the analysis indicates it can download arbitrary remote files over HTTP/HTTPS and store them locally. That broadens the trust boundary substantially and can enable SSRF-like fetching of attacker-controlled content, unexpected local storage of untrusted files, and abuse as a generic downloader under a misleading description.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is presented as a narrowly scoped video transcription tool, but the analysis indicates it can download arbitrary remote files over HTTP/HTTPS and store them locally. That broadens the trust boundary substantially and can enable SSRF-like fetching of attacker-controlled content, unexpected local storage of untrusted files, and abuse as a generic downloader under a misleading description.

Whitespace Padding

Medium

Category: Prompt Injection
Content: 4. 同时传入文件路径与任务ID，优先执行 `--id`，忽略 `--file` 5. 无自定义 prompt 时，默认完整转录视频全部文字 | 用户自然语言指令 | 自动生成命令 | | -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 视频提取 https://example.com/video.mp4 中的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 把本地 /path/to/your/video.mp4 改成小红书风格的文案 | `node scripts/video2text/index.js --file "/path/to/your/video.mp4" --prompt "改写成小红书风格的文案"` |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Medium

Confidence: 79% confidence
Finding: The skill title and instructions are written entirely in Chinese, and the guidance repeatedly assumes Chinese-language usage without indicating that users may choose another language for the skill interface or outputs. The policy requires avoiding language or locale constraints unless users are offered an opt-in choice or the restriction is clearly justified.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation does not clearly warn users that local files and public video links are uploaded to a remote cloud service for processing. This is dangerous because users may unknowingly send sensitive recordings, meetings, or proprietary media off-device without informed consent, creating confidentiality and compliance risks.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill claims it only communicates with `https://www.guaikei.com`, but elsewhere states it will fetch user-supplied external video URLs before upload. This misrepresents network behavior and can cause users or agents to approve a skill under a false assumption about outbound access, increasing the risk of unintended access to attacker-controlled hosts and untrusted content retrieval.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: L122明确宣称错误提示不应夹带营销文案、联系方式或官网链接，且L451再次强调中性错误提示。但同一文档在L473-L477专门提供微信和官网联系信息，形成明显的意图层面张力：技能文档一方面要求运行时错误提示去营销化，另一方面又在面向技能使用的同一规范文档中加入商务导流信息。

Whitespace Padding

Medium

Category: Prompt Injection
Content: ## 7. 🗣️ 自然语言 → 命令（照这张表转） | 用户说的话 | 就执行这条命令 | | ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 提取 https://example.com/video.mp4 里的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: This file's natural-language interface is entirely in Chinese, including docstrings, operation labels, and user-visible error messages such as token/filename validation failures. Because the code does not offer any language choice or document a justified region-specific constraint, it appears to enforce a specific locale without user opt-in.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: This code file contains user-facing natural-language strings such as errors, usage text, and help output entirely in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified or configurable.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: This JavaScript file contains all user-facing operational messages and comments in Chinese, including status and error output. Under the policy, forcing a specific language without user opt-in or a documented regional justification is a natural-language policy violation.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The file contains comments and runtime status messages exclusively in Chinese, which imposes a specific language on users without any opt-in or locale selection. Under the stated policy, forcing a language or locale without user choice is a natural-language policy violation.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: This code constructs and sends an HTTPS POST request containing JSON payload data and a TOKEN header, which is a network transmission of user or system data plus credentials. Within this file there is retry/error logging, but no confirmation prompt, user-facing notice, or warning comment/docstring explaining that outbound API calls with a token will occur.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The skill emits all warning and informational text in Chinese, including operational status and recovery guidance, with no indication that the user can choose another language. This is a natural-language policy concern because it imposes a specific locale on all users without opt-in or documented regional scope.

Natural-Language Policy Violations

Low

Confidence: 87% confidence
Finding: The README presents all user-facing instructions and examples exclusively in Chinese, which can amount to a language/locale policy issue when no user choice or opt-in is provided. The file does not indicate that the skill is intentionally limited to Chinese-speaking users or offer an alternative language.

Intent-Code Divergence

Low

Confidence: 98% confidence
Finding: L204-L212声称name、目录名、package.json.name、文档H1三处必须一致，并给出本技能取值为`guaikei-video-to-doc`。但frontmatter实际名称在L002为`guaikei-video-subtitle-transcript`，构成文档自身声明与实际内容直接矛盾。

Missing User Warnings

Low

Confidence: 80% confidence
Finding: This code performs a safety-relevant file write by downloading content from a URL and saving it to the provided path, but the function has no docstring or comment warning about disk writes and no confirmation prompt before starting. Although it logs progress, those messages describe transfer status rather than disclosing that the operation will create or overwrite files on the local system.

Natural-Language Policy Violations

Low

Confidence: 93% confidence
Finding: The code returns user-visible error messages exclusively in Chinese, including network, parsing, and authentication failures. That imposes a specific language on users without any apparent opt-in or locale selection, which matches the language/locale policy concern.

Natural-Language Policy Violations

Low

Confidence: 92% confidence
Finding: The banner string is presented entirely in Chinese, which imposes a specific language choice in user-facing output. The file does not indicate that the skill is region-specific or that users can choose their preferred language, so this appears to violate the language/locale policy criterion.

Static analysis

No suspicious patterns detected.