Security audit

guaikei-video2text-ai

Security checks for vulnerabilities and agentic risk

Overview

This skill is built for cloud video transcription, but it deserves review because selected media can be fetched from broad URLs and uploaded through under-scoped third-party destinations.

Install only if you are comfortable sending selected videos, prompts, the service token, and some filename/path metadata to GuaiKei and its cloud upload workflow. Avoid using untrusted, internal, or private-network URLs with this skill, and do not use it for sensitive media unless you have independently accepted the provider's retention, deletion, privacy, and billing terms.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/utils/validator.js:3
Finding: Arbitrary URL Fetching Enables SSRF and External Data Relay
Content: View full analysis
this.__opts.maxRedirects) { const err = new Error("Too many redirects"); this.__setState(this.__states.FAILED); this.emit("error", err); return reject(err); } const redirectedURL = /^https?:\/\//.test(response.headers.location) ? response.headers.location : new URL(response.headers.location, url).href; this.emit("redirected", redirectedURL, url); return getRequest(redirectedURL, getReqOptions(redirectedURL)); } ``` ```js // scripts/video2text/index.js:140-146 const presignedUrl = await video.getPresignedUrl(tokenValue, file); if (!presignedUrl || !presignedUrl?.url || presignedUrl.url === "") { throw new Error("获取预签名URL失败，请反馈给开发者"); } utils.printInfo("上传文件到安全空间..."); await upload.uploadFileToOSS(file, presignedUrl.url, presignedUrl.headers); ``` ### Technical Analysis The URL validator verifies only that the input uses the `http:` or `https:` scheme. It does not resolve or ...[truncated 2389 chars]
Remediation: View remediation

other

Note

Location: scripts/api/video.js:11
Finding: Full Local File Paths Are Disclosed to the External API
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/utils/upload.js:10
Finding: API-Controlled Upload Destination Is Not Host-Allowlisted
Content: View full analysis
{ const fileStats = fs.statSync(filename); const totalSize = fileStats.size; let uploadedSize = 0; let settled = false; const fileStream = fs.createReadStream(filename); // 复制预签名 headers，并补充 OSS PUT 必需字段 const uploadHeaders = Object.assign({}, headers); // 关键修复：明确 Content-Length，否则 Node 对流式 body 默认使用 chunked // Transfer-Encoding，阿里云 OSS 预签名 PUT 通常会拒绝而返回 400/403 uploadHeaders["Content-Length"] = String(totalSize); if (!uploadHeaders["Content-Type"]) { uploadHeaders["Content-Type"] = "application/octet-stream"; } const options = { host: url.hostname, path: url.pathname + url.search, method: "PUT", headers: uploadHeaders, }; ``` ### Technical Analysis The presign API controls the upload URL and upload headers. The client validates only that the URL uses HTTPS; it does not verify that the hostname belongs to an approved object-storage provider or expected account. Consequently, a compromised, malicious, or misconfigured API response can direct a user-selected local file to any HTTPS server. The supplied headers are also forwarded without ...[truncated 1329 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill claims to process video inputs but the finding indicates token validation, configuration checks, and marketing/contact prompts are part of the effective behavior. That mismatch is risky because it can steer users into out-of-band credential acquisition and trust decisions unrelated to the technical task, while obscuring what the code actually does with data and secrets.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill claims to process video inputs but the finding indicates token validation, configuration checks, and marketing/contact prompts are part of the effective behavior. That mismatch is risky because it can steer users into out-of-band credential acquisition and trust decisions unrelated to the technical task, while obscuring what the code actually does with data and secrets.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill claims to process video inputs but the finding indicates token validation, configuration checks, and marketing/contact prompts are part of the effective behavior. That mismatch is risky because it can steer users into out-of-band credential acquisition and trust decisions unrelated to the technical task, while obscuring what the code actually does with data and secrets.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill claims to process video inputs but the finding indicates token validation, configuration checks, and marketing/contact prompts are part of the effective behavior. That mismatch is risky because it can steer users into out-of-band credential acquisition and trust decisions unrelated to the technical task, while obscuring what the code actually does with data and secrets.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The entire README presents usage, instructions, support, and examples only in Chinese, including required onboarding and prompt examples, with no indication that other languages are supported or that the language choice is optional. This can violate a language/locale policy when a skill effectively requires a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · README.md (reported line 99)May include surrounding context.
md
4. 同时传入文件路径与任务ID，优先执行 `--id`，忽略 `--file` 5. 无自定义 prompt 时，默认完整转录视频全部文字 | 用户自然语言指令 | 自动生成命令 | | -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 视频提取 https://example.com/video.mp4 中的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 把本地 /path/to/your/video.mp4 改成小红书风格的文案 | `node scripts/video2text/index.js --file "/path/to/your/video.mp4" --prompt "改写成小红书风格的文案"` |

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill declares access to an environment variable (GUAIKEI_API_TOKEN) but does not define an explicit tool scope such as permissions or allowed-tools. In agent environments, missing scoping weakens least-privilege guarantees and can make secret access and execution boundaries ambiguous, especially for a skill that also promotes external network use and opaque backend processing.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The activation guidance is broad enough to match many common content-analysis and rewriting requests, which can cause the agent to invoke this skill in situations beyond strict video transcription. In context, that increases the chance of unnecessary external data transfer of user content to a third-party service and over-collection relative to user intent.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.
md
当用户用自然语言下达指令时，按以下映射生成命令，保证识别与执行一致： | 用户自然语言指令 | 生成的命令 | | ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 提取 https://example.com/video.mp4 里的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The natural-language-to-command mapping uses permissive auto-invocation rules such as inferring --id last reuse and automatically embedding free-form prompts. This can lead to processing the wrong prior task, sending unintended content to the backend, or executing on stale context without explicit user confirmation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This file uses Chinese-only natural-language comments and user-facing error/status strings such as "token 必须是非空字符串" and labels like "预上传" and "视频文案". Per the policy, forcing a specific language without offering user choice or documenting a justified locale constraint is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This file hardcodes user-facing help text, warnings, and error messages in Chinese throughout the parser, such as parameter errors and usage/help output. That creates a language/locale constraint without offering the user a choice or documenting that the skill is intentionally region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This JavaScript file contains natural-language comments and all user-visible status/error messages exclusively in Chinese, such as the docstring and download progress messages. Under the policy rule, forcing a specific language without user opt-in or a documented regional justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The natural-language strings in thrown errors are hard-coded in Chinese, including user-directed remediation text. This enforces a specific language/locale without any opt-in or documented justification, which matches the language/locale policy violation criterion.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This code constructs and sends an HTTPS POST request containing caller-provided JSON data and an authentication token header. While the function has validation and retry logging, there is no user-facing warning, confirmation, or explicit comment/docstring disclosing that data and credentials are transmitted over the network.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file emits all user-facing status and warning messages exclusively in Chinese, including operational guidance and promotional text. This imposes a specific language on users without any opt-in, fallback, or indication that the skill is intended only for a Chinese-speaking or region-specific context.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The comment makes strong privacy and retention assurances about uploaded videos being used only for transcription and automatically deleted, but this file only performs an HTTPS upload and contains no mechanism to enforce, verify, or audit deletion or downstream-use restrictions. In a video-to-text skill handling potentially sensitive user media, such misleading claims can cause users or integrators to trust data handling guarantees that are not technically implemented.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The skill description, examples, usage guidance, and support flow are entirely Chinese-centric, including platform-specific rewriting targets and Chinese-language acquisition instructions, with no indication that users may choose another language for interaction. Because the policy applies to natural-language constraints, this can be treated as a locale/language default imposed without explicit opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The natural-language comment is written entirely in Chinese and describes the skill behavior in that locale without offering any language or locale choice. Under the stated policy, forcing or assuming a specific language without user opt-in can be a policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The banner string is hard-coded in Chinese, which indicates the skill presents itself in a specific language without any visible mechanism for user language selection. This is a natural-language policy concern because the file enforces a locale-specific user-facing message rather than offering a choice.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.