Security audit

guaikei-video-transcript

Security checks for vulnerabilities and agentic risk

Overview

This is a real cloud transcription skill, but it can send more than just intended media to remote services because file, URL, and upload destinations are not tightly scoped.

Review this skill before installing. Use it only with media files and links you explicitly intend to send to GuaiKei's cloud service, avoid passing sensitive local paths, and avoid untrusted URLs unless it runs in a contained environment with restricted filesystem and network access. Treat the privacy and deletion claims as provider promises rather than guarantees enforced by this client.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/utils/validator.js:11
Finding: Arbitrary Local Files Can Be Uploaded to the Remote Service
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/utils/validator.js:3
Finding: Unrestricted URL Downloads Permit Server-Side Request Forgery
Content: View full analysis
this.__opts.maxRedirects) { const err = new Error("Too many redirects"); this.__setState(this.__states.FAILED); this.emit("error", err); return reject(err); } const redirectedURL = /^https?:\/\//.test(response.headers.location) ? response.headers.location : new URL(response.headers.location, this.url).href; this.__isRedirected = true; this.__initProtocol(redirectedURL); this.emit("redirected", redirectedURL, this.url); return this.__start(); } ``` ### Technical Analysis The skill intentionally accepts remote media URLs, but validation only limits the scheme to HTTP or HTTPS. It does not reject destinations resolving to: - IPv4 or IPv6 loopback addresses - Private network ranges - Link-local addresses - Cloud instance metadata services - Reserved, multicast, or unspecified addresses - Internal DNS names - Public hostnames that resolve or rebind to private addresses The downloader also follows up to ten redirects. Each redirect is converted into a new request without applying any network-range validation. A publicly accessible URL can therefore redirect the downloader to an internal endpoint. Content obtained from the target is written to a local temporary file and then uploaded to the external transcription service. This can ...[truncated 1539 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/utils/helper.js:27
Finding: Unbounded Remote Downloads Can Exhaust Local Disk and Network Resources
Content: View full analysis
{ const options = { retry: { maxRetries: constants.CREATE_MAX_ATTEMPTS, delay: constants.RETRY_INTERVAL, }, override: { skip: true, skipSmaller: true }, }; let progressLog = ""; const dl = new Downloader(url, path, options); ``` The downloader records the declared size but does not enforce a maximum: ```js if (!this.__isResumed) { this.__total = parseInt(response.headers["content-length"]) || null; this.__resetStats(); } if (this.__isResumed && response.statusCode === 200) { this.__isResumed = false; this.__total = parseInt(response.headers["content-length"]) || null; this.__resetStats(); } ``` It then creates a writable stream for the response: ```js const _fileName = this.__getFileNameFromHeaders(response.headers); this.__filePath = this.__getFilePath(_fileName); this.__fileName = this.__filePath.split(path.sep).pop(); if (fs.existsSync(this.__filePath)) { const downloadedSize = this.__getFilesizeInBytes(this.__filePath); if (this.__isFileAlreadyDownloaded(downloadedSize)) { this.__setState(this.__states.FINISHED); this.emit("skip", { total: this.__total, name: this.__fileName, fileName: this.__fileName, filePath: this.__filePath, downloaded: downloadedSize, }); return resolve(true); } } this.__fileStream = fs.createWriteStream(this.__filePath, {}); ``` ### Technical Analysis There is no maximum accepted `Content-Length`, no streamed-byte limit, and no overall download deadline. A server may d ...[truncated 1648 chars]
Remediation: View remediation

other

Warning

Location: scripts/utils/upload.js:10
Finding: Presigned Upload Destination Is Not Restricted to Documented Service Domains
Content: View full analysis
{ const fileStats = fs.statSync(filename); const totalSize = fileStats.size; let uploadedSize = 0; let settled = false; const fileStream = fs.createReadStream(filename); // 复制预签名 headers，并补充 OSS PUT 必需字段 const uploadHeaders = Object.assign({}, headers); // 关键修复：明确 Content-Length，否则 Node 对流式 body 默认使用 chunked // Transfer-Encoding，阿里云 OSS 预签名 PUT 通常会拒绝而返回 400/403 uploadHeaders["Content-Length"] = String(totalSize); if (!uploadHeaders["Content-Type"]) { uploadHeaders["Content-Type"] = "application/octet-stream"; } const options = { host: url.hostname, path: url.pathname + url.search, method: "PUT", headers: uploadHeaders, }; const req = https.request( { ...options, timeout: constants.REQUEST_TIMEOUT }, (res) => { ``` The skill documentation states that network requests are limited to `https://www.guaikei.com`, but the upload implementation accepts any HTTPS hostname returned by the API. ### Technical Analysis The upload URL and request headers are supplied by the remote presign API. The client verifies only that the URL uses HTTPS. It does not independently validate: - The upload hostname - The hostname's resolved address - The destination port - Whether the domain belongs to an approved object-storage provider - Whether returned headers are within an expected allowlist Presigned object-storage uploads commonly require a different domain from the application's API domain, but that domain must be explicitly docume ...[truncated 1433 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill advertises media transcription but, per the finding, may also download arbitrary remote files, manage partial downloads, and write local files beyond the narrow user-visible task. If true in the implementation, this expands the attack surface to SSRF-like retrieval, unwanted persistence, and broader file-handling than users are led to expect.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill advertises media transcription but, per the finding, may also download arbitrary remote files, manage partial downloads, and write local files beyond the narrow user-visible task. If true in the implementation, this expands the attack surface to SSRF-like retrieval, unwanted persistence, and broader file-handling than users are led to expect.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill advertises media transcription but, per the finding, may also download arbitrary remote files, manage partial downloads, and write local files beyond the narrow user-visible task. If true in the implementation, this expands the attack surface to SSRF-like retrieval, unwanted persistence, and broader file-handling than users are led to expect.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill advertises media transcription but, per the finding, may also download arbitrary remote files, manage partial downloads, and write local files beyond the narrow user-visible task. If true in the implementation, this expands the attack surface to SSRF-like retrieval, unwanted persistence, and broader file-handling than users are led to expect.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The entire skill documentation, examples, prompts, and contact instructions are presented only in Chinese, and the workflow assumes Chinese-language usage without offering an alternative language or opt-in choice. This can violate language or locale policy where skills should not force a specific language absent user selection or a clearly documented regional justification.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README defines broad natural-language trigger examples such as '总结一下这个视频的核心观点' and maps them directly to command execution patterns. In an agent setting, this can cause ordinary conversational requests to be misclassified as a tool invocation, leading to unintended upload of local files or fetching remote URLs for cloud transcription.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · README.md (reported line 99)May include surrounding context.
md
4. 同时传入文件路径与任务ID，优先执行 `--id`，忽略 `--file` 5. 无自定义 prompt 时，默认完整转录视频全部文字 | 用户自然语言指令 | 自动生成命令 | | -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 视频提取 https://example.com/video.mp4 中的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 把本地 /path/to/your/video.mp4 改成小红书风格的文案 | `node scripts/video2text/index.js --file "/path/to/your/video.mp4" --prompt "改写成小红书风格的文案"` |

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares access to an environment variable (GUAIKEI_API_TOKEN) but does not define an explicit tool scope such as permissions or allowed-tools. In agent environments, undeclared capability boundaries make it harder to enforce least privilege and can allow the skill to run with broader access assumptions than users expect.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The metadata and description contain dense keyword-style trigger language designed to maximize activation across many adjacent tasks. In context, this increases the chance of accidental invocation and unintended transfer of user media/content to the vendor service, which is risky because the skill is networked and depends on a third-party tokenized API.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The activation guidance is extremely broad and encourages the skill to trigger for a wide range of common writing, summarization, and content-creation intents. In an agentic system, overbroad routing can cause sensitive local files or user-provided links to be sent to a third-party cloud service when the user may only want generic text assistance.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.
md
当用户用自然语言下达指令时，按以下映射生成命令，保证识别与执行一致： | 用户自然语言指令 | 生成的命令 | | ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 提取 https://example.com/video.mp4 里的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest description lists many generic use cases such as transcription, meeting notes, course breakdowns, livestream review, and content creation, but it does not specify how or when the skill should be invoked versus other skills. In a manifest file, this kind of broad natural-language scope can create ambiguous activation conditions and increase the chance of unintended invocation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The description is entirely written in Chinese and advertises outputs such as Chinese-platform copywriting for Xiaohongshu and Douyin, but it does not indicate whether users can choose another language or locale. Under the policy, forcing a specific language or locale without opt-in can be a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This file's comments, parameter error messages, and operation labels are all written in Chinese, including user-visible error text such as "token 必须是非空字符串" and labels passed to API requests. That enforces a specific language/locale without offering a user choice or documenting a justified locale constraint, which matches the policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This code contains natural-language content such as the comment at L24-L25 and multiple user-facing status/error messages in Chinese, but there is no indication that the skill is region-specific or that users can opt into this language. That can violate language/locale policy by forcing a specific language on users without choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The string literal instructs the user in Chinese and includes remediation guidance only in that language. This is a natural-language policy concern because the file imposes a specific language for user-facing messaging without any opt-in or alternative locale handling.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The string literals shown to users are entirely in Chinese, and the file provides no indication that this skill is China-specific or that users can choose another language. This creates a natural-language locale policy issue because the skill effectively forces a specific language for important operational messaging without opt-in.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The comment makes strong privacy and data-handling assurances ('no leakage, no retention, only used for transcription, automatically deleted') that are not enforced anywhere in this function. In a skill that uploads user videos/audio to a remote service, this creates a trust and compliance risk: users may submit sensitive recordings based on guarantees the code does not technically verify, enforce, or audit.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The banner text is hard-coded in Chinese, which imposes a specific language on users without any indication of opt-in, fallback, or regional justification. This matches the language/locale policy concern for natural-language content in code files.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This file contains natural-language comments and user-facing CLI messages exclusively in Chinese, including errors and help output. Under the stated policy, forcing a specific language without offering user choice or documenting a justified locale constraint is a language/locale policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The natural-language documentation and user-facing strings in this file are written only in Chinese, indicating a fixed language choice with no opt-in or alternative locale. Under the stated policy, forcing a specific language without user choice is a locale-policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.