Security audit

videotocaption

Security checks for vulnerabilities and agentic risk

Overview

This video transcription skill mostly does what it says, but its URL handling and cloud upload path are too broad and under-disclosed for automatic trust.

Review before installing. Use it only for videos you are comfortable sending to the GuaiKei service and its storage provider. Do not give it confidential recordings or internal/private URLs unless that transfer is approved, and prefer local files or known public video links from a constrained network environment.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/utils/validator.js:3
Finding: Unrestricted URL Download Enables Server-Side Request Forgery and External Data Exfiltration
Content: View full analysis
{ if (this.__isRequireRedirect(response)) { redirectCount++; if (redirectCount > this.__opts.maxRedirects) { const err = new Error("Too many redirects"); this.__setState(this.__states.FAILED); this.emit("error", err); return reject(err); } const redirectedURL = /^https?:\/\//.test(response.headers.location) ? response.headers.location : new URL(response.headers.location, url).href; this.emit("redirected", redirectedUR ...[truncated 3199 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/api/video.js:19
Finding: Full Local Filesystem Path Is Disclosed to the External API
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (29)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill advertises video transcription, but its documented behavior includes generic remote downloading over HTTP/HTTPS, local file writes, metadata probing, and retry controls. Those capabilities materially expand risk: attacker-supplied URLs could trigger SSRF-like access, download unexpected content, or persist untrusted data locally, especially since the manifest frames public links broadly rather than tightly constraining allowed domains.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill advertises video transcription, but its documented behavior includes generic remote downloading over HTTP/HTTPS, local file writes, metadata probing, and retry controls. Those capabilities materially expand risk: attacker-supplied URLs could trigger SSRF-like access, download unexpected content, or persist untrusted data locally, especially since the manifest frames public links broadly rather than tightly constraining allowed domains.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill advertises video transcription, but its documented behavior includes generic remote downloading over HTTP/HTTPS, local file writes, metadata probing, and retry controls. Those capabilities materially expand risk: attacker-supplied URLs could trigger SSRF-like access, download unexpected content, or persist untrusted data locally, especially since the manifest frames public links broadly rather than tightly constraining allowed domains.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The usage section actively instructs users to submit local video files or public video URLs to a third-party cloud processing service, but it does not present a clear, proximate warning that the content leaves the user's environment and is transmitted to an external provider. Although the README later makes privacy assurances, those are marketing claims rather than an informed-consent warning at the point of use, so users may upload sensitive recordings, meetings, interviews, or internal media without understanding the disclosure risk.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · README.md (reported line 99)May include surrounding context.
md
4. 同时传入文件路径与任务ID，优先执行 `--id`，忽略 `--file` 5. 无自定义 prompt 时，默认完整转录视频全部文字 | 用户自然语言指令 | 自动生成命令 | | -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 视频提取 https://example.com/video.mp4 中的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 把本地 /path/to/your/video.mp4 改成小红书风格的文案 | `node scripts/video2text/index.js --file "/path/to/your/video.mp4" --prompt "改写成小红书风格的文案"` |

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill requests access to an environment secret (GUAIKEI_API_TOKEN) but does not declare an explicit tool scope or permissions boundary. In agent environments, missing scope declarations can cause over-broad execution rights and make secret handling less auditable, increasing the chance of unintended secret exposure or misuse.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The manifest description states output types such as meeting notes, copywriting, and translation entirely in Chinese terms and does not indicate user language choice. This creates a locale-policy issue because the skill appears oriented to Chinese output by default rather than explicitly offering language selection up front.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill processes user-supplied videos and links via a remote service, but the warning about remote upload is not presented prominently up front. This creates a privacy and informed-consent risk: users may provide sensitive local files or URLs without realizing the content will be transmitted off-host to a third party.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The documentation states that error messages should be neutral and should not include marketing copy, contact information, or website links. However, nearby documentation and later sections repeatedly embed the vendor website and WeChat contact in operational guidance, which contradicts the stated intent of keeping failure handling free of promotional material.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest description advertises many loosely bounded use cases such as transcription, summarization, rewriting, translation, and content generation across multiple platforms without clearly defining when the skill should or should not be invoked. In agentic environments, broad trigger language increases the chance of over-invocation, unintended handling of sensitive user content, or routing tasks to this skill outside its safe operational scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This JavaScript file contains natural-language strings exclusively in Chinese across docstrings, operation labels, and error messages. Under the policy rules, forcing a specific language without user opt-in or a clearly documented regional constraint is a language/locale policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file's comments, error messages, and generated help text are all hard-coded in Chinese, including thrown errors and CLI help output. This creates a language/locale policy concern because the skill enforces a specific language for user-facing interactions without any opt-in, fallback, or documented region-specific justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This module performs HTTP/HTTPS requests and writes downloaded content to disk, including deleting partial files on stop or failure, but the file contains no confirmation prompt and no user-facing disclosure such as a print/log statement or explanatory docstring about these safety-relevant actions. Because the operations affect local files and transmit data over the network, the absence of any in-file warning meets the code-file criteria for missing user disclosure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The code emits a fixed Chinese-language error string in a user-facing exception message. This imposes a specific language/locale choice without offering the user any language selection or documented justification, which matches the natural-language locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This error message is presented only in Chinese and includes support instructions, making it clearly user-facing natural language. Because the skill does not offer language opt-in or document a justified region-specific restriction here, it violates the language/locale policy guidance.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Across these lines, thrown errors for input validation, parsing, timeout, and retry exhaustion are hard-coded in Chinese. These are user-visible natural-language strings and collectively force a locale without opt-in or documented justification, which falls under the policy violation category.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file emits all user-facing warning and status text exclusively in Chinese, including the critical message that the skill is paused and instructions for remediation. This creates a language/locale policy concern because the skill does not appear to offer any language selection or opt-in for non-Chinese output.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill processes local videos and public URLs through an external cloud service, but the description does not clearly warn users that their content and possibly fetched URLs will be uploaded off-host. For a media-transcription skill, this omission is significant because users may submit confidential recordings, meetings, interviews, or internal training videos without informed consent.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trust section states the skill only communicates with guaikei.com, but the skill also accepts arbitrary public video URLs and documents downloading remote media before upload. That mismatch hides the real network exposure surface from users and reviewers, which matters because processing untrusted external URLs can trigger unexpected outbound requests and data transfer to third parties.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill promises uploaded video is destroyed and not stored, but other sections describe task ID reuse for up to 24 hours and temporary local file retention. These contradictory retention claims can cause users to share sensitive media under false assumptions about deletion and persistence.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation claims errors will be neutral and free of marketing/contact information, yet nearby sections instruct users to obtain tokens via the vendor website or WeChat and include direct business contact details. This inconsistency can mislead users and downstream agents about what may be emitted during failure handling, increasing the risk of social-engineering style prompts or policy bypass through trusted error channels.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.
md
## 7. 🗣️ 自然语言 → 命令（照这张表转） | 用户说的话 | 就执行这条命令 | | ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 提取 https://example.com/video.mp4 里的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · video2text-ai-1.0.1/SKILL.md (reported line 156)May include surrounding context.
md
## 7. 🗣️ 自然语言 → 命令（照这张表转） | 用户说的话 | 就执行这条命令 | | ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 提取 https://example.com/video.mp4 里的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Section 10 says the skill's declared name is video2text-ai, presented as a compliance claim. The actual frontmatter name at the top of the file is videotocaption, so the documentation actively misstates the implemented manifest identity.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The natural-language metadata is overwhelmingly Chinese-specific, including the main description and most keywords, but there is no indication that users can choose another language or that the locale restriction is intentional and documented. This may violate language/locale policy when a skill implicitly forces one language without opt-in.
Content: No source excerpt is available for this finding.