Security audit

guaikei视频转文稿

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims: it turns user-provided videos or video links into text through a cloud service, so users should only provide media they are comfortable uploading.

Install only if you are comfortable sending the videos or URLs you provide to Guaikei's cloud service using your API token. Avoid internal-only URLs, private recordings, regulated data, or sensitive meetings unless that upload is acceptable for your organization, and keep GUAIKEI_API_TOKEN private.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documented behavior includes network download and local file writes, but that capability is easy to miss from the user-facing purpose statement. In an agent setting, understated fetch-and-store behavior is dangerous because it expands trust boundaries and can turn ordinary summarization requests into unanticipated remote retrieval and temporary local persistence of sensitive media.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documented behavior includes network download and local file writes, but that capability is easy to miss from the user-facing purpose statement. In an agent setting, understated fetch-and-store behavior is dangerous because it expands trust boundaries and can turn ordinary summarization requests into unanticipated remote retrieval and temporary local persistence of sensitive media.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented behavior includes network download and local file writes, but that capability is easy to miss from the user-facing purpose statement. In an agent setting, understated fetch-and-store behavior is dangerous because it expands trust boundaries and can turn ordinary summarization requests into unanticipated remote retrieval and temporary local persistence of sensitive media.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented behavior includes network download and local file writes, but that capability is easy to miss from the user-facing purpose statement. In an agent setting, understated fetch-and-store behavior is dangerous because it expands trust boundaries and can turn ordinary summarization requests into unanticipated remote retrieval and temporary local persistence of sensitive media.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented behavior includes network download and local file writes, but that capability is easy to miss from the user-facing purpose statement. In an agent setting, understated fetch-and-store behavior is dangerous because it expands trust boundaries and can turn ordinary summarization requests into unanticipated remote retrieval and temporary local persistence of sensitive media.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The entire skill is documented only in Chinese, with Chinese-only examples, prompts, and support instructions, and it does not state that this locale restriction is optional or region-specific. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The README defines very broad natural-language trigger and auto-conversion rules that can map generic user requests directly into command execution parameters such as --file, --id, and --prompt without clear confirmation or scope constraints. In an agent setting, this increases the chance of unintended invocation, misuse of prior task IDs, or processing of attacker-supplied URLs/content when a user's request only loosely matches the documented patterns.

Whitespace Padding

Medium

Category: Prompt Injection
Content: 4. 同时传入文件路径与任务ID，优先执行 `--id`，忽略 `--file` 5. 无自定义 prompt 时，默认完整转录视频全部文字 | 用户自然语言指令 | 自动生成命令 | | -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 视频提取 https://example.com/video.mp4 中的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 把本地 /path/to/your/video.mp4 改成小红书风格的文案 | `node scripts/video2text/index.js --file "/path/to/your/video.mp4" --prompt "改写成小红书风格的文案"` |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger conditions are very broad and include generic tasks like summarization, analysis, meeting notes, course breakdowns, and interview整理. In an agent ecosystem, overbroad activation can cause the skill to intercept common requests and unnecessarily send user content, links, or files to an external service, creating privacy and data-minimization risks.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill does not provide a prominent upfront warning in its high-level description that supplied local files or URLs may be uploaded to a remote service for processing. This weakens informed consent and can lead users or orchestrators to expose sensitive recordings, meetings, or private media without realizing the data leaves the local environment.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The activation guidance covers broad intent categories that overlap with general-purpose writing and analysis requests. This increases the chance that unrelated user content will be routed through a remote third-party processor, which is dangerous when the skill can handle local files and external URLs.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The trust and error-handling sections explicitly state that failure messages should be neutral and should not carry marketing copy, contact information, or website links. However, the same skill documentation later includes a dedicated contact/business section with WeChat and website details, creating an intent-level contradiction about whether operator-facing outputs should avoid promotional/contact content.

Whitespace Padding

Medium

Category: Prompt Injection
Content: ## 7. 🗣️ 自然语言 → 命令（照这张表转） | 用户说的话 | 就执行这条命令 | | ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 提取 https://example.com/video.mp4 里的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Intent-Code Divergence

Medium

Confidence: 99% confidence
Finding: The file says the skill strictly follows a convention where name, package directory, package.json.name, and H1 must all match, yet this section documents `guaikei-video-to-doc` while the actual manifest name at L002 is `guaikei-video-to-script`. This is an active contradiction between the documentation's claimed identity contract and the file's declared identity.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: This code uses Chinese for user-facing errors, comments, and generated help output, including thrown error messages and the help text shown to CLI users. Because the skill does not offer language selection or document a justified locale restriction, it can violate the policy against forcing a specific language without user opt-in.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: This code performs remote HTTP/HTTPS requests and writes downloaded content to disk, and it can also delete partial files on stop or failure. While it emits internal events, there is no confirmation prompt, visible print/log statement, or code comment/docstring warning users that network transfer, local file creation, and possible file deletion will occur.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The docstring and runtime status messages are written only in Chinese, including download, retry, resume, and error notices. This imposes a specific language on users without any opt-in, fallback, or documented justification for a locale-specific constraint.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: This code constructs and sends HTTPS POST requests containing JSON payload data and a TOKEN header, which may transmit user or system data to a remote service. Within this file there is no confirmation prompt, user-facing disclosure, or explanatory comment warning that data and credentials are being sent over the network.

Natural-Language Policy Violations

Medium

Confidence: 98% confidence
Finding: The file emits all warning and informational text in Chinese, including error, warning, and promotional messages, with no indication that the user can opt into another language. This creates a natural-language locale policy issue because the skill imposes a specific language on users rather than offering a choice or documenting a justified region-specific constraint.

Intent-Code Divergence

Low

Confidence: 99% confidence
Finding: This section is not merely incomplete; it explicitly states a different frontmatter name than the one actually present in the file. Because the section presents itself as normative documentation for this exact skill, it directly conflicts with the code-adjacent manifest data.

Natural-Language Policy Violations

Low

Confidence: 92% confidence
Finding: The package description is entirely in Chinese and presents the skill's behavior only in that locale. Under the policy, language or locale constraints should either offer user choice or be clearly documented as a justified region-specific limitation, which is not present here.

Missing User Warnings

Low

Confidence: 80% confidence
Finding: This code performs a network download and writes data to the filesystem via `new Downloader(url, path, options)`. While it logs transfer progress and failures, there is no explicit user-facing warning or confirmation that the function will fetch remote content and create or modify a local file at the provided path.

Natural-Language Policy Violations

Low

Confidence: 93% confidence
Finding: Multiple natural-language error strings are written only in Chinese, including messages shown when requests fail or when the API token is invalid. This can violate language/locale policy when the skill does not provide user opt-in, fallback localization, or a documented region-specific justification.

Natural-Language Policy Violations

Low

Confidence: 95% confidence
Finding: The banner string is hard-coded in Chinese, which creates a language/locale constraint in the skill's user-facing output. The file does not indicate that this skill is intentionally region-specific or that users can opt into a different language, so it may violate language-choice policy guidance.

Static analysis

No suspicious patterns detected.