Security audit

Guaikei Video Transcript Extractor

Security checks for vulnerabilities and agentic risk

Overview

The skill largely matches its video transcription purpose, but it can fetch arbitrary web URLs and upload the result to a cloud service despite under-disclosing that risk.

Review before installing. Use this only for trusted public videos or local media you intend to send to GuaiKei and its storage provider. Do not provide localhost, private-network, cloud metadata, or sensitive internal URLs, and treat task IDs as sensitive. Do not rely solely on the artifact's automatic-deletion claims without independent assurance from the service provider.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/utils/validator.js:3
Finding: Unrestricted URL Fetching Can Exfiltrate Internal Resources Through Automatic Cloud Upload
Content: View full analysis
this.__opts.maxRedirects) { const err = new Error("Too many redirects"); this.__setState(this.__states.FAILED); this.emit("error", err); return reject(err); } const redirectedURL = /^https?:\/\//.test(response.headers.location) ? response.headers.location : new URL(response.headers.location, this.url).href; this.__isRedirected = true; this.__initProtocol(redirectedURL); this.emit("redirected", redirectedURL, this.url); return this.__start(); } ``` ### Technical Analysis The URL validator only verifies that the supplied value uses the HTTP or HTTPS scheme. It does not reject loopba ...[truncated 2296 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/utils/helper.js:27
Finding: Unbounded Remote Downloads Permit Disk, Bandwidth, and Execution-Time Exhaustion
Content: View full analysis
{ const options = { retry: { maxRetries: constants.CREATE_MAX_ATTEMPTS, delay: constants.RETRY_INTERVAL, }, override: { skip: true, skipSmaller: true }, }; let progressLog = ""; const dl = new Downloader(url, path, options); ``` ```js const _fileName = this.__getFileNameFromHeaders(response.headers); this.__filePath = this.__getFilePath(_fileName); this.__fileName = this.__filePath.split(path.sep).pop(); if (fs.existsSync(this.__filePath)) { const downloadedSize = this.__getFilesizeInBytes(this.__filePath); const totalSize = this.__total ? this.__total : 0; if ( typeof this.__opts.override === "object" && this.__opts.override.skip && (this.__opts.override.skipSmaller || downloadedSize >= totalSize) ) { this.emit("skip", { totalSize: this.__total, fileName: this.__fileName, filePath: this.__filePath, downloadedSize: downloadedSize, }); this.__setState(this.__states.SKIPPED); return resolve(true); } } this.__fileStream = fs.createWriteStream(this.__filePath, {}); ``` ```js readable.on("data", (chunk) => this.__calculateStats(chunk.length)); this.__pipes.forEach((pipe) => { readable.pipe(pipe.stream, pipe.options); readable = pipe.stream; }); readable.pipe(this.__fileStream); ``` ### Technical Analysis The downloader does not define a maximum accepted `Content-Length`, a maximum number of streamed bytes, or a maximum media size. It writes the response directly to disk until the source closes the stream. A remote server can omit `Content-Length`, provide a dishonest value, or send a very large or effectively endless response. The implem ...[truncated 1518 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/utils/utils.js:36
Finding: Reusable Task Identifier Is Persisted in a Predictable File Without Explicitly Restrictive Permissions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 代码片段仅包含 args.js 工具函数：readValueAfterFlag、parseArgs 和 buildHelp，用于命令行参数读取、校验、帮助信息生成。这属于底层 CLI 支持逻辑，而声明描述的是一个视频转写与内容加工技能。依据评估标准，若代码主行为与描述的核心能力 materially different，则应判定为不匹配。当前片段没有任何视频读取、音视频转录、网络请求、云端解析、文本生成或内容分析相关实现，因此与声明用途明显不符。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的核心能力是“视频内容转文字并进一步生成总结/文案”等内容理解与文本处理能力；而这段代码的实际功能只是底层网络下载组件。它访问远程 URL、将响应内容保存到本地、支持重试和续传，但没有任何音视频解析、ASR 转写、字幕提取、摘要生成、翻译或内容分析实现。因此其主要目的与声明明显不一致。虽然下载远程视频文件可能是整条技能链路中的辅助步骤，但仅凭该代码块来看，实际行为是通用文件下载而非视频转写加工，应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared purpose centers on media ingestion and text generation from video content. The actual code chunk is a small utility that loads package.json from disk and returns the package name. This behavior is materially unrelated to the declared functionality and does not implement any of the advertised capabilities. While this could be a supporting helper within a larger project, based on the supplied chunk alone, its behavior does not accurately represent the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个视频内容转写与文案加工技能，但该代码片段的实际功能只是验证一个 API token 是否符合格式要求，并在无效时打印暂停提示和获取私有 token 的广告信息。这不属于声明中的核心能力，也没有体现对视频文件、平台链接、云端解析、转写、总结或文案生成的任何实现。虽然 token 校验可被视为某些技能的辅助组件，但就当前提供的代码片段而言，其行为与声明目的明显不一致，且主要表现为鉴权/营销提示而非视频处理，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · README.md (reported line 99)May include surrounding context.
md
4. 同时传入文件路径与任务ID，优先执行 `--id`，忽略 `--file` 5. 无自定义 prompt 时，默认完整转录视频全部文字 | 用户自然语言指令 | 自动生成命令 | | -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 视频提取 https://example.com/video.mp4 中的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 把本地 /path/to/your/video.mp4 改成小红书风格的文案 | `node scripts/video2text/index.js --file "/path/to/your/video.mp4" --prompt "改写成小红书风格的文案"` |

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger description is extremely broad and covers generic content-analysis intents, increasing the chance the agent invokes this skill for unrelated user requests. Because the skill can upload local files or fetch remote video links to a third-party service, overbroad auto-invocation can cause unnecessary data disclosure and unintended external processing.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The 'when to use' section instructs priority invocation for many broad intents without sufficient guardrails. In a skill that sends user-supplied media to an external service and supports reuse via historical task IDs, this can lead to unintended third-party data transfer or the wrong tool being selected for sensitive content-processing tasks.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.
md
当用户用自然语言下达指令时，按以下映射生成命令，保证识别与执行一致： | 用户自然语言指令 | 生成的命令 | | ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 提取 https://example.com/video.mp4 里的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The package metadata advertises very broad capabilities and includes an extensive set of generic content-creation and transcription keywords, which can cause the skill to activate for a wide range of loosely related user requests. In an agent ecosystem, overbroad triggering increases the chance of unintended invocation, exposing user files, URLs, or prompts to this skill when a narrower tool would have been more appropriate.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This JavaScript file contains natural-language comments, error messages, and help output entirely in Chinese, including user-facing strings such as parameter errors and usage text. Under the policy, forcing a specific language without user opt-in or a documented locale-specific justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This code performs network requests to arbitrary URLs and writes the response to disk, and related methods can delete partially downloaded files on stop or failure. While the module emits internal events, there is no confirmation prompt, print/log statement, or inline comment/docstring warning users that data will be fetched and files may be created or removed locally.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This JavaScript file contains natural-language comments and runtime status/error messages exclusively in Chinese, such as the download docstring and progress/failure notices. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code emits user-visible error messages exclusively in Chinese, including parsing, timeout, and token failure messages. That imposes a specific language on users without any visible opt-in, language selection, or justification for a locale-specific constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code emits all user-facing warning and status text exclusively in Chinese, including the error path and recovery instructions. That creates a language/locale policy issue because the skill does not offer a language choice or document that it is intentionally limited to Chinese-speaking users.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The comment explicitly promises that uploaded videos will be automatically deleted after transcription, but this function only performs an upload and contains no deletion logic, retention control, or verification that downstream cleanup occurs. In a skill handling potentially sensitive user videos, this creates a privacy and data-retention risk because users may rely on the stated guarantee while their content could remain stored indefinitely or longer than expected.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The user-facing instructions, examples, and operational guidance are entirely in Chinese, and the skill does not state that Chinese is optional or that other languages are supported for interaction. Under the language/locale policy, forcing a specific language without user opt-in can be a natural-language policy issue unless the locale restriction is documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This JavaScript file contains natural-language strings exclusively in Chinese, including user-visible error messages such as "token 必须是非空字符串" and operation labels like "预上传". Under the policy rules, forcing a specific language without user opt-in can be a locale-policy violation when no justification or language-selection mechanism is present.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code constructs and sends an HTTPS POST request with a TOKEN header and JSON body, which may transmit user or system data to a remote service. Within this file, there is no confirmation prompt or user-facing notice describing that network transmission, only internal error handling and retry logging.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The banner text is hard-coded in Chinese, which indicates the skill presents itself in a specific language regardless of user preference. The policy allows locale constraints only when users are given a choice or the restriction is clearly documented and justified, neither of which is evident in this file.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.