Security audit

v2t

Security checks for vulnerabilities and agentic risk

Overview

This video transcription skill appears to do its advertised job, but it needs Review because it uploads user media to cloud storage while accepting broad remote URLs and making privacy and network-scope claims the code does not fully enforce.

Install only if you are comfortable sending the selected video, its local path metadata, and any downloaded remote-link content to the provider's cloud workflow. Avoid confidential, regulated, or internal videos unless the provider's retention and deletion promises are acceptable to you, and do not process untrusted URLs from other people because the downloader can reach network locations visible from your machine.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/utils/validator.js:3
Finding: Arbitrary URL Fetching Enables Server-Side Request Forgery
Content: View full analysis
{ if (this.__isRequireRedirect(response)) { redirectCount++; if (redirectCount > this.__opts.maxRedirects) { const err = new Error("Too many redirects"); this.__setState(this.__states.FAILED); this.emit("error", err); return reject(err); } const redirectedURL = /^https?:\/\//.test(response.headers.location) ? response.headers.location : new URL(response.headers.location, url).href; this.emit("redirected", redirectedURL, url); return getRequest(redirectedURL, getReqOptions(redirectedURL)); } ``` ### Technical Analysis The URL validator verifies only that the input uses the HTTP or HTTPS scheme. It does not resolve and inspect the destination address or reject loopback, private, link-local, reserved, or cloud metadata address rang ...[truncated 1957 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/utils/helper.js:27
Finding: Unbounded Remote Downloads Allow Resource Exhaustion
Content: View full analysis
{ const options = { retry: { maxRetries: constants.CREATE_MAX_ATTEMPTS, delay: constants.RETRY_INTERVAL, }, override: { skip: true, skipSmaller: true }, }; let progressLog = ""; const dl = new Downloader(url, path, options); ``` ```javascript // scripts/utils/download.js:526-549 const _fileName = this.__getFileNameFromHeaders(response.headers); this.__filePath = this.__getFilePath(_fileName); this.__fileName = this.__filePath.split(path.sep).pop(); if (fs.existsSync(this.__filePath)) { const downloadedSize = this.__getFilesizeInBytes(this.__filePath); if ( !this.__opts.override || (this.__opts.override.skip && (!this.__opts.override.skipSmaller || downloadedSize >= this.__total)) ) { this.__setState(this.__states.FINISHED); this.emit("skip", { fileName: this.__fileName, filePath: this.__filePath, totalSize: this.__total, downloadedSize, }); return resolve(true); } } if (this.__downloaded === 0) { this.__fileStream = fs.createWriteStream(this.__filePath, {}); } else { this.__fileStream = fs.createWriteStream(this.__filePath, { flags: "a" }); } ``` ### Technical Analysis The downloader writes remote response bodies to disk without enforcing a maximum number of bytes. The wrapper does not configure a file-size limit, validate the declared `Content-Length`, enforce an overall download deadline, verify available disk space, or reject missing and implausibly large lengths. A hostile endpoint can return a very large object, omit `Content-Length`, use chunked transfer encoding, or con ...[truncated 1694 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/utils/upload.js:10
Finding: Server-Controlled Presigned URL Can Redirect Local File Uploads to Arbitrary HTTPS Hosts
Content: View full analysis
{ const fileStats = fs.statSync(filename); const totalSize = fileStats.size; let uploadedSize = 0; let settled = false; const fileStream = fs.createReadStream(filename); // 复制预签名 headers，并补充 OSS PUT 必需字段 const uploadHeaders = Object.assign({}, headers); // 关键修复：明确 Content-Length，否则 Node 对流式 body 默认使用 chunked // Transfer-Encoding，阿里云 OSS 预签名 PUT 通常会拒绝而返回 400/403 uploadHeaders["Content-Length"] = String(totalSize); if (!uploadHeaders["Content-Type"]) { uploadHeaders["Content-Type"] = "application/octet-stream"; } const options = { host: url.hostname, path: url.pathname + url.search, method: "PUT", headers: uploadHeaders, }; const req = https.request( { ...options, timeout: constants.REQUEST_TIMEOUT }, ``` ### Technical Analysis The upload destination and upload headers are obtained from the remote API. The client validates only that the returned URL uses HTTPS. It does not verify that the hostname belongs to an approved object-storage provider, ex ...[truncated 1843 chars]
Remediation: View remediation

other

Note

Location: scripts/api/video.js:11
Finding: Absolute Local File Paths Are Disclosed to the Remote API
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (24)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The finding indicates token validation, promotional output, and workflow gating based on token state beyond the core advertised function. Mixing authentication checks with marketing/contact prompts can socially pressure users to disclose or obtain credentials through out-of-band channels, increasing phishing and trust-boundary risks in a skill that handles user media.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The finding indicates token validation, promotional output, and workflow gating based on token state beyond the core advertised function. Mixing authentication checks with marketing/contact prompts can socially pressure users to disclose or obtain credentials through out-of-band channels, increasing phishing and trust-boundary risks in a skill that handles user media.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The finding indicates token validation, promotional output, and workflow gating based on token state beyond the core advertised function. Mixing authentication checks with marketing/contact prompts can socially pressure users to disclose or obtain credentials through out-of-band channels, increasing phishing and trust-boundary risks in a skill that handles user media.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The finding indicates token validation, promotional output, and workflow gating based on token state beyond the core advertised function. Mixing authentication checks with marketing/contact prompts can socially pressure users to disclose or obtain credentials through out-of-band channels, increasing phishing and trust-boundary risks in a skill that handles user media.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The finding indicates token validation, promotional output, and workflow gating based on token state beyond the core advertised function. Mixing authentication checks with marketing/contact prompts can socially pressure users to disclose or obtain credentials through out-of-band channels, increasing phishing and trust-boundary risks in a skill that handles user media.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · README.md (reported line 99)May include surrounding context.
md
4. 同时传入文件路径与任务ID，优先执行 `--id`，忽略 `--file` 5. 无自定义 prompt 时，默认完整转录视频全部文字 | 用户自然语言指令 | 自动生成命令 | | -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 视频提取 https://example.com/video.mp4 中的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 把本地 /path/to/your/video.mp4 改成小红书风格的文案 | `node scripts/video2text/index.js --file "/path/to/your/video.mp4" --prompt "改写成小红书风格的文案"` |

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill description does not prominently warn users that submitted videos or links are uploaded to a cloud service for processing. This undermines informed consent and can cause sensitive media to be transferred off-device unexpectedly, which is particularly risky for private meetings, interviews, or proprietary content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The activation guidance fails to clearly disclose that online videos may be downloaded into a local temporary directory before being uploaded for processing. This creates hidden data-handling and storage behavior that may violate user expectations, local policy, or data-minimization requirements.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The document promises neutral error messages without marketing, yet elsewhere embeds website and WeChat contact information for token acquisition and support. In a security-sensitive workflow, this inconsistency weakens trust signals and can normalize off-platform contact or credential-related social engineering.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This file contains natural-language comments, exceptions, and help text entirely in Chinese, including user-facing CLI output such as error messages and usage/help text. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This module performs HTTP/HTTPS requests to arbitrary URLs and writes the retrieved content to disk, including deleting partial files on stop or failure, but the code provides no confirmation prompt, print/log message, or explanatory comment warning users about these safety-relevant actions. Because these operations affect local files and transmit data to remote endpoints, the lack of disclosure in the code makes the behavior insufficiently transparent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code emits user-facing error strings exclusively in Chinese, including operational guidance and remediation text. That creates a language policy violation when no user language choice or documented locale justification is present in the file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file emits all user-facing status and warning messages exclusively in Chinese, including the warning and recovery instructions. This is a natural-language locale policy concern because the skill does not provide user opt-in, fallback language support, or any documented justification that the skill is intended only for Chinese-speaking users.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The comment makes a strong privacy and retention promise for uploaded videos ('only used for transcription' and 'automatically deleted after completion'), but this module implements only upload behavior and provides no enforcement of deletion or data lifecycle controls. In a video-to-text skill handling potentially sensitive user media, such misleading assurances can cause privacy harm, regulatory exposure, and over-retention of user content if downstream deletion is absent or fails silently.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill sends user-supplied videos or public video links to a third-party cloud service for transcription, but the user-facing description does not clearly and prominently warn that media content is uploaded off-device for external processing. This can cause users to disclose sensitive recordings, personal data, or confidential meeting content without informed consent, especially because the skill is framed as a generic video-to-text utility and emphasizes convenience over data-sharing risk.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.
md
## 7. 🗣️ 自然语言 → 命令（照这张表转） | 用户说的话 | 就执行这条命令 | | ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 提取 https://example.com/video.mp4 里的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · video2text-ai-1.0.1/SKILL.md (reported line 156)May include surrounding context.
md
## 7. 🗣️ 自然语言 → 命令（照这张表转） | 用户说的话 | 就执行这条命令 | | ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 提取 https://example.com/video.mp4 里的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The README is entirely written in Chinese and all example prompts and invocation patterns assume Chinese-language use, but the documentation does not state that the skill is region-specific or provide any language/locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: L198 的规范约定写明“命名：name: video2text-ai”，而 manifest 顶部 L002 的实际名称是“v2t”。这不是单纯信息缺失，而是文档对技能标识的明确陈述与实际 frontmatter 相冲突，可能误导调用方或维护者。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The file's docstrings and user-visible error/operation labels are written exclusively in Chinese, including status labels passed into API requests and thrown error messages. This can violate a language/locale policy when a skill enforces one language without offering the user a choice or documenting a justified locale restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code contains natural-language comments and user-facing log/error strings entirely in Chinese, including operational notices about file cleanup and deletion failures. Because there is no indication that the skill is region-specific or that users can opt into this locale, it may violate the language/locale policy for skills expected to serve a broader audience.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This JavaScript file contains multiple user-visible status and error messages in Chinese, such as download progress, retry, resume, and failure notices. That can violate language/locale policy because the skill forces a specific language without offering opt-in or documenting a justified region-specific scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The banner string is explicitly in Chinese ("视频文案智能提取助手"), which indicates a fixed language choice in user-facing output. Under the policy rules, hard-coding a specific language without opt-in or documented locale justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.