Security audit

guaikei-video-transcript-extractor

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it advertises, but it can upload arbitrary local files and fetch arbitrary web URLs with weaker limits and disclosure than users should expect.

Review before installing. Use this only with videos you intentionally want to send to the GuaiKei service and its storage provider. Do not let untrusted pages, prompts, or collaborators choose the --file path or URL. Avoid sensitive local paths, private/internal URLs, and very large remote files until the publisher adds explicit confirmation, media validation, host restrictions, size limits, and accurate destination disclosure.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/utils/validator.js:3
Finding: Unrestricted URL Fetching Enables SSRF and Internal Data Exfiltration
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/utils/validator.js:11
Finding: Arbitrary Readable Local Files Can Be Uploaded to Remote Storage
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/utils/helper.js:28
Finding: Unbounded Remote Downloads Can Exhaust Local Disk Space
Content: View full analysis
{ const options = { retry: { maxRetries: constants.CREATE_MAX_ATTEMPTS, delay: constants.RETRY_INTERVAL, }, override: { skip: true, skipSmaller: true }, }; let progressLog = ""; const dl = new Downloader(url, path, options); ``` The response is streamed directly to disk without enforcing a byte limit: ```js readable.on("data", (chunk) => this.__calculateStats(chunk.length)); this.__pipes.forEach((pipe) => { readable.pipe(pipe.stream, pipe.options); readable = pipe.stream; }); readable.pipe(this.__fileStream); readable.on("error", this.__onError(resolve, reject)); this.__fileStream.on("finish", this.__onFinished(resolve, reject)); this.__fileStream.on("error", this.__onError(resolve, reject)); ``` ### Technical Analysis The downloader does not define a maximum accepted `Content-Length`, streamed-byte threshold, media duration, free-space requirement, or download timeout in the helper configuration. A server may omit `Content-Length`, use chunked transfer encoding, report a false size, or continuously stream data. Because data is piped directly to a file, the process continues consuming disk space until the remote endpoint closes the connection, an external timeout occurs, or the filesystem becomes full. The 24-hour cleanup routine does not mitigate an active oversized or endless download. Retry behavior may also repeat resource consumption following network failures. ### Attack Path 1. An attacker supplies a URL controlled by an endpoint that returns an extremely large or continuous response. 2. URL validation accepts the endpoint. 3. The downloader creates a file in the proje ...[truncated 610 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/utils/upload.js:10
Finding: API-Controlled Upload Destination Is Not Restricted to Trusted Storage Hosts
Content: View full analysis
{ ``` The parsed hostname and API-provided headers are then used directly: ```js const options = { host: url.hostname, path: url.pathname + url.search, method: "PUT", headers: uploadHeaders, }; const req = https.request( { ...options, timeout: constants.REQUEST_TIMEOUT }, ``` ### Technical Analysis The only destination security check is that the presigned URL uses HTTPS. The hostname, port, path, query string, and most request headers originate from the remote API response and are trusted without validation. This behavior also conflicts with the documentation's statement that the Skill only sends HTTPS requests to `www.guaikei.com`; object-storage uploads necessarily contact another destination unless storage is hosted under that domain. If the API is compromised, misconfigured, or manipulated upstream, it can return a presigned URL for any HTTPS host. The Skill will then upload the complete user-selected file to that destination. HTTPS protects transport confidentiality but does not establish that the destination is authorized. ### Attack Path 1. The presign API is compromised or returns a malicious or incorrectly configured response. 2. The response specifies an attacker-controlled HTTPS upload host and optional headers. 3. `uploadFileToOSS()` verifies only the scheme. 4. The function opens the selected local file and sends it to the supplied host using HTTP `PUT`. 5. The attacker-controlled server receives the file. ### Impact Assessment The issue can redirect uploaded user videos or arbitrary readable local ...[truncated 303 chars]
Remediation: View remediation

other

Note

Location: scripts/api/video.js:17
Finding: Presign Requests Disclose Complete Local Filesystem Paths
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill advertises processing arbitrary public video URLs and likely performs generic network download and local file write behavior to handle them. Without explicit restrictions on allowed domains, file size, storage paths, redirect handling, and protocol validation, this can create SSRF-like fetch abuse, unexpected internal network access in permissive runtimes, or disk/resource exhaustion from attacker-controlled URLs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill advertises processing arbitrary public video URLs and likely performs generic network download and local file write behavior to handle them. Without explicit restrictions on allowed domains, file size, storage paths, redirect handling, and protocol validation, this can create SSRF-like fetch abuse, unexpected internal network access in permissive runtimes, or disk/resource exhaustion from attacker-controlled URLs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill advertises processing arbitrary public video URLs and likely performs generic network download and local file write behavior to handle them. Without explicit restrictions on allowed domains, file size, storage paths, redirect handling, and protocol validation, this can create SSRF-like fetch abuse, unexpected internal network access in permissive runtimes, or disk/resource exhaustion from attacker-controlled URLs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill advertises processing arbitrary public video URLs and likely performs generic network download and local file write behavior to handle them. Without explicit restrictions on allowed domains, file size, storage paths, redirect handling, and protocol validation, this can create SSRF-like fetch abuse, unexpected internal network access in permissive runtimes, or disk/resource exhaustion from attacker-controlled URLs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill advertises processing arbitrary public video URLs and likely performs generic network download and local file write behavior to handle them. Without explicit restrictions on allowed domains, file size, storage paths, redirect handling, and protocol validation, this can create SSRF-like fetch abuse, unexpected internal network access in permissive runtimes, or disk/resource exhaustion from attacker-controlled URLs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README encourages users to submit local video files or public video links to a cloud-backed processing service, but it does not clearly warn at the point of use that content is transmitted to a remote third-party server for processing. This can mislead users into sending sensitive or regulated media under the assumption the tool operates locally, creating privacy, confidentiality, and compliance risk.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · README.md (reported line 99)May include surrounding context.
md
4. 同时传入文件路径与任务ID，优先执行 `--id`，忽略 `--file` 5. 无自定义 prompt 时，默认完整转录视频全部文字 | 用户自然语言指令 | 自动生成命令 | | -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 视频提取 https://example.com/video.mp4 中的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 把本地 /path/to/your/video.mp4 改成小红书风格的文案 | `node scripts/video2text/index.js --file "/path/to/your/video.mp4" --prompt "改写成小红书风格的文案"` |

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill description is extremely broad ('handle all video-to-text needs') and overlaps with general content analysis and copywriting tasks. Overbroad activation increases the chance that an agent invokes this skill for ordinary requests and unnecessarily uploads local files or third-party URLs to an external service, causing unintended data disclosure and spend.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The manifest description is entirely in Chinese and frames the skill's use cases and outputs from a Chinese-language perspective, but does not indicate language choice or opt-in. For a generally scoped skill, this can amount to an implicit locale/language constraint without documenting user selection.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The guidance says to prioritize the skill whenever any matching intent appears, and the listed categories include broad writing and analysis scenarios. In an agentic environment, that can steer unrelated user requests into a networked third-party workflow, increasing privacy exposure, wrong-tool execution, and unnecessary token-billed operations.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.
md
当用户用自然语言下达指令时，按以下映射生成命令，保证识别与执行一致： | 用户自然语言指令 | 生成的命令 | | ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 提取 https://example.com/video.mp4 里的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The package description advertises very broad capabilities across local files, public links, transcription, analysis, summarization, rewriting, and style transformation without stating clear trigger boundaries, supported-source restrictions, or abuse-prevention constraints. In an agent ecosystem, this can cause over-invocation, unsafe handling of arbitrary remote content, and use in higher-risk content transformation scenarios without explicit user confirmation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This JavaScript file uses Chinese-only natural-language documentation and error/status strings throughout, such as comments and thrown messages, with no indication that the skill supports user language selection or is intentionally limited to a Chinese-only context. That can violate language/locale policy when a skill imposes a language without user opt-in or explicit justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The stop() and __removeFile() logic can unlink downloaded files when removeOnStop or removeOnFail is enabled, which is a destructive file operation covered by the missing-warning rule. The code includes no confirmation prompt and no direct user-facing warning that stopping or failed downloads may delete partially downloaded files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This downloader accepts arbitrary HTTP/HTTPS URLs, follows redirects, and writes the response to a local file path derived from remote-controlled headers or URL path. In a skill whose advertised purpose includes fetching public video links, this creates a real SSRF and untrusted file-write primitive if upstream callers do not strictly validate allowed domains, schemes, destinations, and file types.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Multiple user-visible error strings are written only in Chinese, such as request failures, parse failures, token errors, and timeout/network messages. This imposes a specific language on users without any evident locale selection or documented regional constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code emits all warning and informational messages exclusively in Chinese, including error and recovery guidance. For a general utility file with no documented region-specific scope or language choice, this constitutes a natural-language locale policy issue because users are not offered an opt-in or alternative language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The banner text is explicitly Chinese-language text ("视频文案智能提取助手"), which indicates a fixed language/locale choice in user-facing output. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the constraint is justified or configurable.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The natural-language description and author contact metadata are presented only in Chinese, which may effectively constrain the skill's usability and interaction expectations to a specific language without stating that this is optional or region-specific. The policy requires avoiding language or locale constraints unless users are given a choice or the limitation is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file’s natural-language comments and all user-facing error/help strings are written in Chinese, indicating the skill is designed to communicate in a single language by default. Under the policy, forcing a specific language without offering a user choice or documenting a justified locale constraint is a natural-language policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This JavaScript file contains natural-language comments and user-facing status/error messages entirely in Chinese, such as the doc comment at L24-L26 and progress/error output at L41, L45, L51, L61, L73, and L78. Under the policy rule for language/locale, this is a violation because the skill imposes a specific language without any opt-in or documented locale constraint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: This code sends JSON data over HTTPS and includes a TOKEN header, which can transmit user or system data to a remote service. In this file, there is no confirmation prompt or explicit user-facing disclosure near the network operation itself; only retry/error handling is present.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.