Security audit

understoodvideo

Security checks for vulnerabilities and agentic risk

Overview

This skill performs the advertised video-to-text task, but its network and upload behavior is broader and less clearly bounded than its safety claims suggest.

Review before installing, especially if you handle confidential recordings, internal meeting videos, customer data, or regulated media. Use it only when you are comfortable sending the selected media, prompt, task metadata, and possibly local path information to the provider, and avoid untrusted or internal URLs because the downloader is not tightly restricted to public video platforms.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/utils/validator.js:3
Finding: Arbitrary URL Fetching Enables SSRF and External Exfiltration
Content: View full analysis
this.__opts.maxRedirects) { const err = new Error("Too many redirects"); this.__setState(this.__states.FAILED); this.emit("error", err); return reject(err); } const redirectedURL = /^https?:\/\//.test(response.headers.location) ? response.headers.location : new URL(response.headers.location, this.url).href; this.__isRedirected = true; this.__initProtocol(redirectedURL); this.emit("redirected", redirectedURL, this.url); return this.__start(); ``` ### Technical Analysis URL validation checks only whether the scheme is HTTP or HTTPS. It does not reject: - Loopback destinations such as `127.0.0.1` or `[::1]` - RFC1918 private networks - Link-local addresses, including cloud metadata services - Reserved or multicast address ranges - Hostnames that resolve to private addresses - Public URLs that redirect to private destinations - DNS rebinding between validation an ...[truncated 1831 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/utils/download.js:35
Finding: Unbounded Downloads Permit Disk and Process Resource Exhaustion
Content: View full analysis
{ const options = { retry: { maxRetries: constants.CREATE_MAX_ATTEMPTS, delay: constants.RETRY_INTERVAL, }, override: { skip: true, skipSmaller: true }, }; let progressLog = ""; ``` ```js // scripts/utils/download.js:35-49 this.__defaultOpts = { body: null, retry: false, method: "GET", headers: {}, fileName: "", timeout: -1, metadata: null, override: false, forceResume: false, removeOnStop: true, removeOnFail: true, maxRedirects: 10, progressThrottle: 1000, httpRequestOptions: {}, httpsRequestOptions: {}, ``` ### Technical Analysis The download wrapper does not configure a maximum response size or override the downloader's default `timeout: -1`. As a result, the Skill may continue downloading until the remote peer closes the connection or the host runs out of resources. Reliance on `Content-Length` would not be sufficient because a malicious server can omit it, provide a false value, or stream data using chunked transfer encoding. The implementation needs a streaming byte counter that aborts the request after a configured limit. The retry behavior can compound resource consumption when a malicious or unstable endpoint repeatedly causes incomplete downloads. ### Attack Path 1. An attacker supplies a URL serving an extremely large response, an endless chunked stream, or a deliberately slow response. 2. The Skill accepts the URL and starts downloading it. 3. No total-size limit stops the stream. 4. No total download deadline terminates a slow or stalled transfer. 5. Data continues to be written into the project `tmp` director ...[truncated 766 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/utils/upload.js:12
Finding: API-Controlled Upload Destination Can Receive Arbitrary User Files
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/api/video.js:11
Finding: Full Local Filesystem Path Is Disclosed to the Remote API
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (28)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is described as a content-processing tool, but the analysis indicates token gating and promotional flows are embedded in behavior. This is dangerous because it mixes operational logic with marketing/contact solicitation, which can mislead agents and create opportunities for social engineering or unauthorized external dependency on private credentials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is described as a content-processing tool, but the analysis indicates token gating and promotional flows are embedded in behavior. This is dangerous because it mixes operational logic with marketing/contact solicitation, which can mislead agents and create opportunities for social engineering or unauthorized external dependency on private credentials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill is described as a content-processing tool, but the analysis indicates token gating and promotional flows are embedded in behavior. This is dangerous because it mixes operational logic with marketing/contact solicitation, which can mislead agents and create opportunities for social engineering or unauthorized external dependency on private credentials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is described as a content-processing tool, but the analysis indicates token gating and promotional flows are embedded in behavior. This is dangerous because it mixes operational logic with marketing/contact solicitation, which can mislead agents and create opportunities for social engineering or unauthorized external dependency on private credentials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is described as a content-processing tool, but the analysis indicates token gating and promotional flows are embedded in behavior. This is dangerous because it mixes operational logic with marketing/contact solicitation, which can mislead agents and create opportunities for social engineering or unauthorized external dependency on private credentials.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README directs users to upload local videos or submit public video links to a remote cloud-processing service, but it does not prominently and explicitly warn at the point of use that the media content will leave the local machine and be transmitted to a third party. Because videos may contain sensitive personal, business, or regulated information, this omission can lead users to disclose data without informed consent or policy review.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · README.md (reported line 99)May include surrounding context.
md
4. 同时传入文件路径与任务ID，优先执行 `--id`，忽略 `--file` 5. 无自定义 prompt 时，默认完整转录视频全部文字 | 用户自然语言指令 | 自动生成命令 | | -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 视频提取 https://example.com/video.mp4 中的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 把本地 /path/to/your/video.mp4 改成小红书风格的文案 | `node scripts/video2text/index.js --file "/path/to/your/video.mp4" --prompt "改写成小红书风格的文案"` |

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest description and the broader instructions are written as if the skill operates in Chinese by default, with examples and stylistic guidance centered on Chinese platforms and Chinese output modes, but there is no explicit user opt-in for that locale. Under the policy, a skill should not impose a specific language or locale unless it clearly offers a choice or justifies the restriction as region-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill processes user video/audio in a cloud service, but the description does not clearly and prominently warn users upfront that their content is uploaded remotely. This can cause unintentional disclosure of sensitive recordings, proprietary meetings, or personal data because users may assume local-only processing from the high-level description.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The document claims the skill only talks to a single domain, yet it also describes downloading and parsing external video URLs. That contradiction can mislead users about outbound network behavior, weakening trust and potentially exposing user-supplied URLs, metadata, or content to additional network interactions they did not expect.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file's comments, error messages, and generated help text are entirely in Chinese, including the user-visible CLI help and exceptions. This creates a locale/language policy concern because the skill hard-codes a specific language without offering user opt-in or documenting that the tool is intentionally region-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code issues HTTP/HTTPS requests to arbitrary URLs and writes the response to disk, and it can also delete partially downloaded files on stop or failure. Although these actions are core to a downloader utility, the file contains no confirmation prompt, user-visible disclosure, or inline warning about the data transfer and file deletion behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This JavaScript file contains multiple natural-language strings shown to users in Chinese, such as download progress, retry, skip, and error messages. The file does not provide any opt-in, fallback, or indication that the skill is intentionally limited to a Chinese-language context, which conflicts with the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This code emits Chinese-only messages such as the request failure text, which forces a specific language in user-visible output. Under the policy, locale-specific behavior should either offer user choice or be clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The invalid-token error shown to users is Chinese-only and includes support instructions in that language, which constitutes a language policy violation when no alternative locale or opt-in is provided. This is a natural-language issue independent of the underlying authentication logic.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The user-facing strings in this file are entirely in Chinese, including warnings and operational guidance, with no indication that the skill is region-specific or that users can choose another language. This creates a natural-language policy concern because it imposes a specific language on all users without opt-in.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The comment makes a strong privacy and retention promise about uploaded videos being used only for transcription and automatically deleted, but this function only performs an upload and contains no technical control to enforce deletion, restricted use, or data lifecycle management. In a skill that handles user videos and transcripts, such unsupported assurances can mislead users into sharing sensitive content under false expectations, creating privacy, compliance, and trust risks if the backend retains or repurposes the data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The banner text is fixed in Chinese ("视频文案智能提取助手"), which imposes a specific language in user-facing output. The file does not provide any opt-in, locale selection, or documented justification for restricting output language.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill processes local video files and public URLs by uploading content to a remote third-party service, but the user-facing description does not clearly foreground that data leaves the local environment. This creates a privacy and data-handling risk because users may provide sensitive recordings, meetings, or interviews without informed consent about remote transfer.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: L122 明确写着“错误提示中性，不夹带营销文案、联系方式或官网链接”。但 L103、L268 以及文档整体又要求在 TOKEN 相关场景引导用户去官网开通或加微信联系，这与“错误提示不得包含官网链接/联系方式”的约束直接冲突，属于文档意图与实际指导相矛盾。
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.
md
## 7. 🗣️ 自然语言 → 命令（照这张表转） | 用户说的话 | 就执行这条命令 | | ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 提取 https://example.com/video.mp4 里的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · video2text-ai-1.0.1/SKILL.md (reported line 156)May include surrounding context.
md
## 7. 🗣️ 自然语言 → 命令（照这张表转） | 用户说的话 | 就执行这条命令 | | ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 提取 https://example.com/video.mp4 里的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 60% confidence
Finding: The skill advertises '全文中英互译' as a built-in transformation capability, which can affect output language. However, the README does not explicitly clarify that language changes occur only when the user requests them or otherwise chooses the target language.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: Manifest 描述在 L003 中将外链支持表述为“支持本地视频与抖音、小红书链接”，但正文 L187 又将支持范围扩展到 B站、视频号、微博等公开可直链/可下载的视频页。虽然这更像范围扩展而非安全漏洞，但属于文档层面对技能能力边界的不一致陈述。
Content: No source excerpt is available for this finding.