Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to perform cloud video transcription, but it needs Review because it can download any supplied URL and upload local or downloaded media while its network-scope disclosure is too narrow.
Install only if you are comfortable sending chosen videos, audio, prompts, task ids, and the GUAIKEI token to this cloud service. Confirm every local path or URL before use, avoid confidential or regulated recordings unless authorized, and prefer public media URLs over internal/private-network links.
The analysis indicates the code implements general download functionality rather than the claimed transcription pipeline. In this context, a skill marketed as media-to-text but capable of retrieving arbitrary URLs and managing downloads creates a trust boundary violation: the agent may invoke it for innocent content tasks while it performs broader external fetches and writes attacker-controlled data to disk.
The analysis indicates the code implements general download functionality rather than the claimed transcription pipeline. In this context, a skill marketed as media-to-text but capable of retrieving arbitrary URLs and managing downloads creates a trust boundary violation: the agent may invoke it for innocent content tasks while it performs broader external fetches and writes attacker-controlled data to disk.
The analysis indicates the code implements general download functionality rather than the claimed transcription pipeline. In this context, a skill marketed as media-to-text but capable of retrieving arbitrary URLs and managing downloads creates a trust boundary violation: the agent may invoke it for innocent content tasks while it performs broader external fetches and writes attacker-controlled data to disk.
The analysis indicates the code implements general download functionality rather than the claimed transcription pipeline. In this context, a skill marketed as media-to-text but capable of retrieving arbitrary URLs and managing downloads creates a trust boundary violation: the agent may invoke it for innocent content tasks while it performs broader external fetches and writes attacker-controlled data to disk.
The README encourages uploading local videos and public platform links to a cloud service but does not clearly warn that this transfers potentially sensitive content to a third-party processor. Claims about deletion and non-retention are marketing assurances rather than user-facing risk disclosure, so users may unknowingly send confidential recordings, internal meetings, or personal data off-device.
The README defines very broad natural-language to command conversion rules that accept arbitrary local file paths, remote URLs, and free-form prompts without any visible scope restrictions, validation guidance, or trust boundaries. In an agent setting, this increases the risk that unrelated user text, attacker-supplied links, or sensitive local paths are automatically routed to a cloud-processing action, causing unintended data exfiltration or unsafe tool invocation.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
4. 同时传入文件路径与任务ID，优先执行 `--id`，忽略 `--file`
5. 无自定义 prompt 时，默认完整转录视频全部文字
| 用户自然语言指令 | 自动生成命令 |
| -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
| 视频提取 https://example.com/video.mp4 中的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` |
| 把本地 /path/to/your/video.mp4 改成小红书风格的文案 | `node scripts/video2text/index.js --file "/path/to/your/video.mp4" --prompt "改写成小红书风格的文案"` |
The skill declares access to a sensitive environment variable (GUAIKEI_API_TOKEN) but does not define an explicit tool/permission scope. In an agent setting, undeclared scope makes it harder to constrain or audit what secrets the skill may access, increasing the risk of overbroad secret exposure if the implementation changes or is abused.
The trigger description is extremely broad and covers many generic content-processing intents, which can cause the agent to over-select this skill in situations outside its safe intended scope. Overbroad matching increases the chance that arbitrary links, local files, or sensitive media are routed to an external service without sufficiently specific user intent.
The usage guidance instructs the agent to prioritize this skill for a wide range of intents, with limited exclusions. In an agent ecosystem this can lead to unnecessary external transmission of user media or URLs and can override safer, more specific tools, making data-handling and network exposure broader than users expect.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
当用户用自然语言下达指令时，按以下映射生成命令，保证识别与执行一致：
| 用户自然语言指令 | 生成的命令 |
| ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
| 提取 https://example.com/video.mp4 里的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` |
| 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |
The file uses Chinese-only natural-language strings in docstrings, operation labels, and thrown error messages, which imposes a specific language on users or operators. There is no indication that the skill is region-specific or that users can opt into another language, which matches the locale-policy violation criteria.
This module performs HTTP/HTTPS requests and writes downloaded content to disk, including deleting partial files on stop/failure, but the file contains no confirmation prompt, user-facing print/log message, or explanatory comment/docstring describing these safety-relevant effects. For a reusable utility, the absence of any disclosure makes it easy to invoke data-transfer and file-modification behavior without clear user awareness.
The code constructs and sends a POST request containing JSON data and a TOKEN header, which may transmit user or system data to a remote service. While there is retry/error handling, there is no confirmation prompt or clear user-facing disclosure in this file that data and credentials are being sent over the network.
This JavaScript file contains multiple user-facing notices entirely in Chinese, including warnings and promotional guidance. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.
User-facing descriptions, help examples, and runtime messages are consistently presented only in Chinese. This imposes a specific language on users without any opt-in or documented justification, which matches the language/locale policy violation criteria.
This JavaScript file contains natural-language comments and user-facing CLI messages entirely in Chinese, including thrown errors and generated help text. Under the policy rule for language/locale, this is a violation because the skill does not offer a language choice or indicate that it is intentionally limited to a Chinese-speaking context.
This JavaScript file contains all user-facing messages and comments in Chinese, including operational notices and error messages. For a general-purpose skill, that can amount to a locale/language policy violation if users are not offered a language choice or told the skill is Chinese-only.
This file contains natural-language comments and runtime messages exclusively in Chinese, including download status, retry, and failure notices. The file does not indicate that the skill is region-specific or that users can choose their preferred language, which creates a locale policy concern under the language/locale rule.
The file contains multiple hardcoded Chinese error messages presented directly to users, but there is no indication that the skill is region-specific or that users can opt into this locale. This can violate language/locale policy when a skill imposes one language by default.
The banner text is hardcoded in Chinese, which indicates a fixed language experience rather than allowing user language selection or opt-in. Under the policy rule for natural-language violations, forcing a specific language without user choice is in scope.
No suspicious patterns detected.