Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it claims: it turns user-provided videos or video links into text through a cloud service, so users should only provide media they are comfortable uploading.
Install only if you are comfortable sending the videos or URLs you provide to Guaikei's cloud service using your API token. Avoid internal-only URLs, private recordings, regulated data, or sensitive meetings unless that upload is acceptable for your organization, and keep GUAIKEI_API_TOKEN private.
The documented behavior includes network download and local file writes, but that capability is easy to miss from the user-facing purpose statement. In an agent setting, understated fetch-and-store behavior is dangerous because it expands trust boundaries and can turn ordinary summarization requests into unanticipated remote retrieval and temporary local persistence of sensitive media.
The documented behavior includes network download and local file writes, but that capability is easy to miss from the user-facing purpose statement. In an agent setting, understated fetch-and-store behavior is dangerous because it expands trust boundaries and can turn ordinary summarization requests into unanticipated remote retrieval and temporary local persistence of sensitive media.
The documented behavior includes network download and local file writes, but that capability is easy to miss from the user-facing purpose statement. In an agent setting, understated fetch-and-store behavior is dangerous because it expands trust boundaries and can turn ordinary summarization requests into unanticipated remote retrieval and temporary local persistence of sensitive media.
The documented behavior includes network download and local file writes, but that capability is easy to miss from the user-facing purpose statement. In an agent setting, understated fetch-and-store behavior is dangerous because it expands trust boundaries and can turn ordinary summarization requests into unanticipated remote retrieval and temporary local persistence of sensitive media.
The documented behavior includes network download and local file writes, but that capability is easy to miss from the user-facing purpose statement. In an agent setting, understated fetch-and-store behavior is dangerous because it expands trust boundaries and can turn ordinary summarization requests into unanticipated remote retrieval and temporary local persistence of sensitive media.
The entire skill is documented only in Chinese, with Chinese-only examples, prompts, and support instructions, and it does not state that this locale restriction is optional or region-specific. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
The README defines very broad natural-language trigger and auto-conversion rules that can map generic user requests directly into command execution parameters such as --file, --id, and --prompt without clear confirmation or scope constraints. In an agent setting, this increases the chance of unintended invocation, misuse of prior task IDs, or processing of attacker-supplied URLs/content when a user's request only loosely matches the documented patterns.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
4. 同时传入文件路径与任务ID，优先执行 `--id`，忽略 `--file`
5. 无自定义 prompt 时，默认完整转录视频全部文字
| 用户自然语言指令 | 自动生成命令 |
| -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
| 视频提取 https://example.com/video.mp4 中的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` |
| 把本地 /path/to/your/video.mp4 改成小红书风格的文案 | `node scripts/video2text/index.js --file "/path/to/your/video.mp4" --prompt "改写成小红书风格的文案"` |
Without declared permissions the skill's intent is opaque and cannot be validated.
The trigger conditions are very broad and include generic tasks like summarization, analysis, meeting notes, course breakdowns, and interview整理. In an agent ecosystem, overbroad activation can cause the skill to intercept common requests and unnecessarily send user content, links, or files to an external service, creating privacy and data-minimization risks.
The skill does not provide a prominent upfront warning in its high-level description that supplied local files or URLs may be uploaded to a remote service for processing. This weakens informed consent and can lead users or orchestrators to expose sensitive recordings, meetings, or private media without realizing the data leaves the local environment.
The activation guidance covers broad intent categories that overlap with general-purpose writing and analysis requests. This increases the chance that unrelated user content will be routed through a remote third-party processor, which is dangerous when the skill can handle local files and external URLs.
The trust and error-handling sections explicitly state that failure messages should be neutral and should not carry marketing copy, contact information, or website links. However, the same skill documentation later includes a dedicated contact/business section with WeChat and website details, creating an intent-level contradiction about whether operator-facing outputs should avoid promotional/contact content.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 7. 🗣️ 自然语言 → 命令（照这张表转）
| 用户说的话 | 就执行这条命令 |
| ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
| 提取 https://example.com/video.mp4 里的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` |
| 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |
The file says the skill strictly follows a convention where name, package directory, package.json.name, and H1 must all match, yet this section documents guaikei-video-to-doc while the actual manifest name at L002 is guaikei-video-to-script. This is an active contradiction between the documentation's claimed identity contract and the file's declared identity.
This code uses Chinese for user-facing errors, comments, and generated help output, including thrown error messages and the help text shown to CLI users. Because the skill does not offer language selection or document a justified locale restriction, it can violate the policy against forcing a specific language without user opt-in.
This code performs remote HTTP/HTTPS requests and writes downloaded content to disk, and it can also delete partial files on stop or failure. While it emits internal events, there is no confirmation prompt, visible print/log statement, or code comment/docstring warning users that network transfer, local file creation, and possible file deletion will occur.
The docstring and runtime status messages are written only in Chinese, including download, retry, resume, and error notices. This imposes a specific language on users without any opt-in, fallback, or documented justification for a locale-specific constraint.
This code constructs and sends HTTPS POST requests containing JSON payload data and a TOKEN header, which may transmit user or system data to a remote service. Within this file there is no confirmation prompt, user-facing disclosure, or explanatory comment warning that data and credentials are being sent over the network.
The file emits all warning and informational text in Chinese, including error, warning, and promotional messages, with no indication that the user can opt into another language. This creates a natural-language locale policy issue because the skill imposes a specific language on users rather than offering a choice or documenting a justified region-specific constraint.
This section is not merely incomplete; it explicitly states a different frontmatter name than the one actually present in the file. Because the section presents itself as normative documentation for this exact skill, it directly conflicts with the code-adjacent manifest data.
The package description is entirely in Chinese and presents the skill's behavior only in that locale. Under the policy, language or locale constraints should either offer user choice or be clearly documented as a justified region-specific limitation, which is not present here.
This code performs a network download and writes data to the filesystem via new Downloader(url, path, options). While it logs transfer progress and failures, there is no explicit user-facing warning or confirmation that the function will fetch remote content and create or modify a local file at the provided path.
Multiple natural-language error strings are written only in Chinese, including messages shown when requests fail or when the API token is invalid. This can violate language/locale policy when the skill does not provide user opt-in, fallback localization, or a documented region-specific justification.
The banner string is hard-coded in Chinese, which creates a language/locale constraint in the skill's user-facing output. The file does not indicate that this skill is intentionally region-specific or that users can opt into a different language, so it may violate language-choice policy guidance.