understoodvideo

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:52 AM UTC
• Version: 1.0.0

Overview

This skill performs the advertised video-to-text task, but its network and upload behavior is broader and less clearly bounded than its safety claims suggest.

Review before installing, especially if you handle confidential recordings, internal meeting videos, customer data, or regulated media. Use it only when you are comfortable sending the selected media, prompt, task metadata, and possibly local path information to the provider, and avoid untrusted or internal URLs because the downloader is not tightly restricted to public video platforms.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/utils/validator.js:3
• Finding: Arbitrary URL Fetching Enables SSRF and External Exfiltration<![CDATA[ ## Vulnerability Details **File Location**: `scripts/utils/validator.js:3-8`, `scripts/video2text/index.js:104-105`, `scripts/video2text/index.js:140-145`, `scripts/utils/download.js:479-492` **Vulnerability Type**: Server-Side Request Forgery (SSRF) with external upload **Risk Level**: High ### Vulnerable Code ```js // scripts/utils/validator.js:3-8 function isUrl(url) { try { const parsedUrl = new URL(url); return parsedUrl.protocol === "http:" || parsedUrl.protocol === "https:"; } catch (_) { return false; } } ``` ```js // scripts/video2text/index.js:104-105 if (validator.isUrl(file)) { const filepath = utils.downloadPath(); ``` ```js // scripts/video2text/index.js:140-145 const presignedUrl = await video.getPresignedUrl(tokenValue, file); if (!presignedUrl || !presignedUrl?.url || presignedUrl.url === "") { throw new Error("获取预签名URL失败，请反馈给开发者"); } utils.printInfo("上传文件到安全空间..."); await upload.uploadFileToOSS(file, presignedUrl.url, presignedUrl.headers); ``` ```js // scripts/utils/download.js:479-492 this.__redirectCount++; if (this.__redirectCount > this.__opts.maxRedirects) { const err = new Error("Too many redirects"); this.__setState(this.__states.FAILED); this.emit("error", err); return reject(err); } const redirectedURL = /^https?:\/\//.test(response.headers.location) ? response.headers.location : new URL(response.headers.location, this.url).href; this.__isRedirected = true; this.__initProtocol(redirectedURL); this.emit("redirected", redirectedURL, this.url); return this.__start(); ``` ### Technical Analysis URL validation checks only whether the scheme is HTTP or HTTPS. It does not reject: - Loopback destinations such as `127.0.0.1` or `[::1]` - RFC1918 private networks - Link-local addresses, including cloud metadata services - Reserved or multicast address ranges - Hostnames that resolve to private addresses - Public URLs that redirect to private destinations - DNS rebinding between validation an ...[truncated 1831 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Resolve the hostname before every connection and reject any address in loopback, private, link-local, carrier-grade NAT, multicast, documentation, or other reserved IPv4 and IPv6 ranges. 2. Reapply the complete validation policy after every redirect. 3. Reject IP-literal URLs unless explicitly required. 4. Where practical, use an allowlist of supported public video platforms and approved content-delivery domains. 5. Protect against DNS rebinding by connecting only to the validated resolved address while preserving the expected TLS hostname. 6. Disable redirects by default or limit them to validated destinations using HTTPS. 7. Apply outbound network controls at the operating-system or container level so the process cannot reach internal and metadata networks. 8. Validate that the downloaded response is an expected media type before writing or uploading it. 9. Do not upload content if URL validation, address validation, or media validation fails. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/utils/download.js:35
• Finding: Unbounded Downloads Permit Disk and Process Resource Exhaustion<![CDATA[ ## Vulnerability Details **File Location**: `scripts/utils/helper.js:30-40`, `scripts/utils/download.js:35-49` **Vulnerability Type**: Unrestricted download size and missing download timeout **Risk Level**: Medium ### Vulnerable Code ```js // scripts/utils/helper.js:30-40 async function download(url, path) { return new Promise((resolve, reject) => { const options = { retry: { maxRetries: constants.CREATE_MAX_ATTEMPTS, delay: constants.RETRY_INTERVAL, }, override: { skip: true, skipSmaller: true }, }; let progressLog = ""; ``` ```js // scripts/utils/download.js:35-49 this.__defaultOpts = { body: null, retry: false, method: "GET", headers: {}, fileName: "", timeout: -1, metadata: null, override: false, forceResume: false, removeOnStop: true, removeOnFail: true, maxRedirects: 10, progressThrottle: 1000, httpRequestOptions: {}, httpsRequestOptions: {}, ``` ### Technical Analysis The download wrapper does not configure a maximum response size or override the downloader's default `timeout: -1`. As a result, the Skill may continue downloading until the remote peer closes the connection or the host runs out of resources. Reliance on `Content-Length` would not be sufficient because a malicious server can omit it, provide a false value, or stream data using chunked transfer encoding. The implementation needs a streaming byte counter that aborts the request after a configured limit. The retry behavior can compound resource consumption when a malicious or unstable endpoint repeatedly causes incomplete downloads. ### Attack Path 1. An attacker supplies a URL serving an extremely large response, an endless chunked stream, or a deliberately slow response. 2. The Skill accepts the URL and starts downloading it. 3. No total-size limit stops the stream. 4. No total download deadline terminates a slow or stalled transfer. 5. Data continues to be written into the project `tmp` director ...[truncated 766 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Define a strict maximum media size appropriate to the service. 2. Reject responses whose declared `Content-Length` exceeds that limit. 3. Maintain a streaming byte counter and abort the request when the actual bytes exceed the limit, regardless of response headers. 4. Configure separate DNS, connection, TLS handshake, idle-read, and total-operation deadlines. 5. Delete partial files after any timeout, size violation, validation error, or interrupted transfer. 6. Limit retries and ensure retries do not preserve oversized or untrusted partial content. 7. Check available disk space before beginning a download. 8. Use per-task isolated temporary directories with storage quotas where supported. 9. Validate the response content type and file signature before accepting it as media. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/utils/upload.js:12
• Finding: API-Controlled Upload Destination Can Receive Arbitrary User Files<![CDATA[ ## Vulnerability Details **File Location**: `scripts/utils/upload.js:12-14`, `scripts/utils/upload.js:24-39`, `scripts/video2text/index.js:140-145` **Vulnerability Type**: Insufficient validation of sensitive-data upload destination **Risk Level**: Medium ### Vulnerable Code ```js // scripts/utils/upload.js:12-14 const url = new URL(presignedUrl); if (url.protocol !== "https:") { throw new Error("上传URL必须是HTTPS协议"); } ``` ```js // scripts/utils/upload.js:24-39 // Copy presigned headers and add fields required for the PUT request const uploadHeaders = Object.assign({}, headers); uploadHeaders["Content-Length"] = String(totalSize); if (!uploadHeaders["Content-Type"]) { uploadHeaders["Content-Type"] = "application/octet-stream"; } const options = { host: url.hostname, path: url.pathname + url.search, method: "PUT", headers: uploadHeaders, }; const req = https.request( { ...options, timeout: constants.REQUEST_TIMEOUT }, ``` ```js // scripts/video2text/index.js:140-145 const presignedUrl = await video.getPresignedUrl(tokenValue, file); if (!presignedUrl || !presignedUrl?.url || presignedUrl.url === "") { throw new Error("获取预签名URL失败，请反馈给开发者"); } utils.printInfo("上传文件到安全空间..."); await upload.uploadFileToOSS(file, presignedUrl.url, presignedUrl.headers); ``` ### Technical Analysis The uploader confirms only that the supplied URL uses HTTPS. It does not constrain the hostname, port, or destination network. It also copies arbitrary headers returned by the API. Therefore, the remote control API can direct the client to upload the selected local file to any HTTPS server. A compromised API, altered API response, or malicious service operator could route private media to infrastructure unrelated to the documented service. This behavior also conflicts with the statement in `SKILL.md:119` that the Skill communicates only with `https://www.guaikei.com`. Presigned object-storage uploads commonly require another domain, but those domains should b ...[truncated 1239 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Maintain an explicit allowlist of approved object-storage hostnames or narrowly scoped hostname suffixes. 2. Validate hostname boundaries correctly; for example, do not treat `trusted.example.attacker.com` as a subdomain of `trusted.example`. 3. Reject IP-literal destinations, unexpected ports, embedded credentials, fragments, and private or reserved destination addresses. 4. Permit only headers required by the approved object-storage provider, such as an expected content type and specifically documented signing headers. 5. Reject sensitive or unrelated headers returned by the control API. 6. Verify that the object URL returned after upload belongs to the same approved storage environment. 7. Document all actual network destinations instead of claiming communication occurs only with the control domain. 8. Consider obtaining explicit user consent that identifies the upload destination before transmitting confidential content. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/api/video.js:11
• Finding: Full Local Filesystem Path Is Disclosed to the Remote API<![CDATA[ ## Vulnerability Details **File Location**: `scripts/api/video.js:11-23` **Vulnerability Type**: Unnecessary local environment information disclosure **Risk Level**: Low ### Vulnerable Code ```js async function getPresignedUrl(token, filename) { if (!token || typeof token !== "string") { throw new Error("token 必须是非空字符串"); } if (!filename || typeof filename !== "string") { throw new Error("filename 必须是非空字符串"); } const data = { file: filename }; const response = await requestApi( "/api/video/presign", token, data, ``` ### Technical Analysis The presigning request transmits the complete `filename` value, which is the full local path used by the client. A presigning service generally needs only a sanitized basename, extension, content type, or generated object key. Local paths can contain sensitive contextual information, including: - Operating-system usernames - Organization or customer names - Project names - Internal directory structure - Case identifiers or confidential subject names This metadata is disclosed independently of the later file upload and is not technically necessary for generating a safe object-storage destination. ### Attack Path 1. A user selects a file such as `/home/alice/clients/acme/private-meeting.mp4`. 2. The full path is passed to `getPresignedUrl()`. 3. The complete path is serialized as `{ "file": "/home/alice/clients/acme/private-meeting.mp4" }`. 4. The value is transmitted to `www.guaikei.com`. 5. The remote service can log, retain, or analyze local environment details embedded in the path. ### Impact Assessment The remote API gains information about the host's filesystem layout and the context of the selected file. This does not expose the contents of unrelated files or grant additional privileges, but it increases privacy exposure and may assist social engineering, host profiling, or correlation of sensitive projects. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the full path with `path.basename(filename)` before constructing the API request. 2. Sanitize the basename to remove control characters and unsupported characters. 3. Prefer generating a random object key locally and send only that key plus a validated extension or MIME type. 4. Do not include usernames, parent directories, or original path structure in network requests. 5. Document the minimal metadata sent to the presigning service. 6. Add tests confirming that absolute and relative parent-directory components never leave the client. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (28)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill is described as a content-processing tool, but the analysis indicates token gating and promotional flows are embedded in behavior. This is dangerous because it mixes operational logic with marketing/contact solicitation, which can mislead agents and create opportunities for social engineering or unauthorized external dependency on private credentials.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill is described as a content-processing tool, but the analysis indicates token gating and promotional flows are embedded in behavior. This is dangerous because it mixes operational logic with marketing/contact solicitation, which can mislead agents and create opportunities for social engineering or unauthorized external dependency on private credentials.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The skill is described as a content-processing tool, but the analysis indicates token gating and promotional flows are embedded in behavior. This is dangerous because it mixes operational logic with marketing/contact solicitation, which can mislead agents and create opportunities for social engineering or unauthorized external dependency on private credentials.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill is described as a content-processing tool, but the analysis indicates token gating and promotional flows are embedded in behavior. This is dangerous because it mixes operational logic with marketing/contact solicitation, which can mislead agents and create opportunities for social engineering or unauthorized external dependency on private credentials.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is described as a content-processing tool, but the analysis indicates token gating and promotional flows are embedded in behavior. This is dangerous because it mixes operational logic with marketing/contact solicitation, which can mislead agents and create opportunities for social engineering or unauthorized external dependency on private credentials.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README directs users to upload local videos or submit public video links to a remote cloud-processing service, but it does not prominently and explicitly warn at the point of use that the media content will leave the local machine and be transmitted to a third party. Because videos may contain sensitive personal, business, or regulated information, this omission can lead users to disclose data without informed consent or policy review.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

4. 同时传入文件路径与任务ID，优先执行 `--id`，忽略 `--file`
5. 无自定义 prompt 时，默认完整转录视频全部文字

| 用户自然语言指令                                         | 自动生成命令                                                                                                |
| -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
| 视频提取 https://example.com/video.mp4 中的文字          | `node scripts/video2text/index.js --file "https://example.com/video.mp4"`                                   |
| 把本地 /path/to/your/video.mp4 改成小红书风格的文案      | `node scripts/video2text/index.js --file "/path/to/your/video.mp4" --prompt "改写成小红书风格的文案"`       |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The manifest description and the broader instructions are written as if the skill operates in Chinese by default, with examples and stylistic guidance centered on Chinese platforms and Chinese output modes, but there is no explicit user opt-in for that locale. Under the policy, a skill should not impose a specific language or locale unless it clearly offers a choice or justifies the restriction as region-specific.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill processes user video/audio in a cloud service, but the description does not clearly and prominently warn users upfront that their content is uploaded remotely. This can cause unintentional disclosure of sensitive recordings, proprietary meetings, or personal data because users may assume local-only processing from the high-level description.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The document claims the skill only talks to a single domain, yet it also describes downloading and parsing external video URLs. That contradiction can mislead users about outbound network behavior, weakening trust and potentially exposing user-supplied URLs, metadata, or content to additional network interactions they did not expect.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The file's comments, error messages, and generated help text are entirely in Chinese, including the user-visible CLI help and exceptions. This creates a locale/language policy concern because the skill hard-codes a specific language without offering user opt-in or documenting that the tool is intentionally region-specific.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This code issues HTTP/HTTPS requests to arbitrary URLs and writes the response to disk, and it can also delete partially downloaded files on stop or failure. Although these actions are core to a downloader utility, the file contains no confirmation prompt, user-visible disclosure, or inline warning about the data transfer and file deletion behavior.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This JavaScript file contains multiple natural-language strings shown to users in Chinese, such as download progress, retry, skip, and error messages. The file does not provide any opt-in, fallback, or indication that the skill is intentionally limited to a Chinese-language context, which conflicts with the language/locale policy criteria.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This code emits Chinese-only messages such as the request failure text, which forces a specific language in user-visible output. Under the policy, locale-specific behavior should either offer user choice or be clearly justified as region-specific.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The invalid-token error shown to users is Chinese-only and includes support instructions in that language, which constitutes a language policy violation when no alternative locale or opt-in is provided. This is a natural-language issue independent of the underlying authentication logic.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The user-facing strings in this file are entirely in Chinese, including warnings and operational guidance, with no indication that the skill is region-specific or that users can choose another language. This creates a natural-language policy concern because it imposes a specific language on all users without opt-in.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The comment makes a strong privacy and retention promise about uploaded videos being used only for transcription and automatically deleted, but this function only performs an upload and contains no technical control to enforce deletion, restricted use, or data lifecycle management. In a skill that handles user videos and transcripts, such unsupported assurances can mislead users into sharing sensitive content under false expectations, creating privacy, compliance, and trust risks if the backend retains or repurposes the data.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The banner text is fixed in Chinese ("视频文案智能提取助手"), which imposes a specific language in user-facing output. The file does not provide any opt-in, locale selection, or documented justification for restricting output language.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill processes local video files and public URLs by uploading content to a remote third-party service, but the user-facing description does not clearly foreground that data leaves the local environment. This creates a privacy and data-handling risk because users may provide sensitive recordings, meetings, or interviews without informed consent about remote transfer.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: L122 明确写着“错误提示中性，不夹带营销文案、联系方式或官网链接”。但 L103、L268 以及文档整体又要求在 TOKEN 相关场景引导用户去官网开通或加微信联系，这与“错误提示不得包含官网链接/联系方式”的约束直接冲突，属于文档意图与实际指导相矛盾。

Whitespace Padding

Medium

• Category: Prompt Injection

Content

## 7. 🗣️ 自然语言 → 命令（照这张表转）

| 用户说的话                                           | 就执行这条命令                                                                                              |
| ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
| 提取 https://example.com/video.mp4 里的文字          | `node scripts/video2text/index.js --file "https://example.com/video.mp4"`                                   |
| 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

## 7. 🗣️ 自然语言 → 命令（照这张表转）

| 用户说的话                                           | 就执行这条命令                                                                                              |
| ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
| 提取 https://example.com/video.mp4 里的文字          | `node scripts/video2text/index.js --file "https://example.com/video.mp4"`                                   |
| 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Natural-Language Policy Violations

Low

• Confidence: 60% confidence
• Finding: The skill advertises '全文中英互译' as a built-in transformation capability, which can affect output language. However, the README does not explicitly clarify that language changes occur only when the user requests them or otherwise chooses the target language.

Intent-Code Divergence

Low

• Confidence: 87% confidence
• Finding: Manifest 描述在 L003 中将外链支持表述为“支持本地视频与抖音、小红书链接”，但正文 L187 又将支持范围扩展到 B站、视频号、微博等公开可直链/可下载的视频页。虽然这更像范围扩展而非安全漏洞，但属于文档层面对技能能力边界的不一致陈述。

Static analysis

No suspicious patterns detected.