Security audit
Security checks for vulnerabilities and agentic risk
The skill does what it claims, but its remote-video handling is under-scoped enough that users should review it before installation.
Review this skill before installing if your agent may process untrusted links. Use it only with videos and URLs you trust, avoid confidential recordings unless you accept cloud processing, and be aware that the token error path contains promotional contact messaging.
scripts/utils/validator.js:3Unrestricted URL Download Enables SSRF and External Exfiltration of Internal Resources
scripts/utils/download.js:463Unbounded Remote Downloads Can Exhaust Local Disk Space
The skill appears to gate usage on a private token and may emit promotional messaging for obtaining it, despite positioning itself primarily as a productivity tool. This creates a trust issue and can be abused for off-platform lead capture or coercive workflow interruption rather than transparent, minimal-error handling.
The skill appears to gate usage on a private token and may emit promotional messaging for obtaining it, despite positioning itself primarily as a productivity tool. This creates a trust issue and can be abused for off-platform lead capture or coercive workflow interruption rather than transparent, minimal-error handling.
The skill appears to gate usage on a private token and may emit promotional messaging for obtaining it, despite positioning itself primarily as a productivity tool. This creates a trust issue and can be abused for off-platform lead capture or coercive workflow interruption rather than transparent, minimal-error handling.
The skill appears to gate usage on a private token and may emit promotional messaging for obtaining it, despite positioning itself primarily as a productivity tool. This creates a trust issue and can be abused for off-platform lead capture or coercive workflow interruption rather than transparent, minimal-error handling.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
4. 同时传入文件路径与任务ID，优先执行 `--id`，忽略 `--file`
5. 无自定义 prompt 时，默认完整转录视频全部文字
| 用户自然语言指令 | 自动生成命令 |
| -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
| 视频提取 https://example.com/video.mp4 中的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` |
| 把本地 /path/to/your/video.mp4 改成小红书风格的文案 | `node scripts/video2text/index.js --file "/path/to/your/video.mp4" --prompt "改写成小红书风格的文案"` |
The skill requests access to sensitive environment data via GUAIKEI_API_TOKEN but does not declare an explicit tool scope such as permissions or allowed-tools. In an agent ecosystem, missing scope boundaries increases the chance of overbroad execution privileges and makes it harder for reviewers and runtimes to enforce least privilege.
The examples normalize sending local files and remote links into the tool without any adjacent privacy or data-handling warning. In a media-processing context, omission of such notice can cause accidental disclosure of private recordings, meetings, or copyrighted content to an external processor.
The skill encourages users to provide local video files and URLs for cloud processing without a clear, prominent upfront warning that those materials are uploaded to a third-party service. This weakens informed consent and increases the risk of users exposing sensitive or regulated media they would not otherwise submit.
The document claims errors will not include marketing, contact details, or website links, but elsewhere directs users to obtain tokens via a website and personal WeChat contact. This inconsistency undermines trust and suggests runtime error paths may socially engineer users into off-platform contact, especially when authentication fails.
This JavaScript file contains user-facing natural-language strings entirely in Chinese, including errors, help text, and examples. That enforces a specific language for all users without any visible opt-in, fallback, or documented justification, which matches the locale-policy violation criteria.
This code contains user-facing status and error strings exclusively in Chinese, and the function comment is also Chinese. That imposes a specific language/locale on all users without offering any choice or documenting a justified region-specific constraint, which matches the language/locale policy violation criteria.
This code constructs and sends an HTTPS POST request containing JSON payload data and a TOKEN header, which can transmit user or system data to a remote service. In this file there is no confirmation prompt, user-facing notice, or explanatory comment/docstring warning about the outbound transmission or token use.
The user-facing messages emitted on token validation failure are entirely in Chinese, and there is no indication in this file that the skill detects user locale, offers an opt-in, or documents that it is intentionally China-specific. This creates a natural-language policy concern because the skill imposes a language choice on users without consent or justification.
The top-level description is entirely in Chinese and presents the skill's invocation and behavior in a single locale, which can impose a language expectation on users and orchestrators without any explicit opt-in. Under the policy rule, forcing a specific language is a violation unless the skill clearly offers language choice or justifies a region-specific constraint.
L122 明确宣称错误提示应保持中性，且不夹带营销文案、联系方式或官网链接。但同一文档在 TOKEN 配置章节直接要求用户去官网开通或添加微信，且 L307 再次声称未配 TOKEN 时应输出不附带官网链接或联系方式的中性错误提示，形成明显的意图层矛盾。
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 7. 🗣️ 自然语言 → 命令（照这张表转）
| 用户说的话 | 就执行这条命令 |
| ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
| 提取 https://example.com/video.mp4 里的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` |
| 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 7. 🗣️ 自然语言 → 命令（照这张表转）
| 用户说的话 | 就执行这条命令 |
| ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
| 提取 https://example.com/video.mp4 里的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` |
| 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |
该文档全文以中文编写，并包含中文自然语言指令示例，但未说明这是可选语言、也未提供其他语言或用户选择机制。按规则，若技能强制特定语言而无用户 opt-in，属于自然语言层面的语言/locale 政策风险。
L198 写明命名为 name: video2text-ai，且称其与技能包目录一致；但实际 frontmatter 中的技能名是 vid-note（L002）。这是文档对技能身份的直接自相矛盾，容易误导调用方或维护者。
The package description advertises output formats such as clean copy, summaries, rewrites, quotes, storyboards, and Chinese-English translation, while the keyword list is heavily Chinese-specific and includes platform-specific Chinese copywriting terms like 小红书文案 and 抖音文案. This suggests a default Chinese-language/content orientation without stating that users can choose another language, which may violate language/locale choice expectations.
The string literal for authentication failure is fixed in Chinese and does not offer any locale or language opt-in. This can violate language or locale policy when the skill is expected to operate for users in multiple languages.
The manifest describes a video-to-text and content-generation skill, but this utility embeds an operational support channel message directing users to contact a specific WeChat number when authentication fails. That capability is not needed to perform transcription or rewriting, and introduces an out-of-band commercial/support interaction not justified by the stated purpose.
The user-facing banner string is entirely in Chinese, which imposes a specific language on all users of this utility. Under the policy criteria, forcing a locale or language without opt-in or justification is a natural-language policy violation.
No suspicious patterns detected.