T09 · Insecure Skill Coding Practices
Error
- Location
scripts/utils/validator.js:12- Finding
Arbitrary Local Files Can Be Uploaded to an External Service
- Content
View full analysis
- Remediation
View remediation
Security audit
Video2text Ai 1.0.1
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to implement its advertised cloud video transcription workflow, but its file and URL handling can send broader local or internal data to remote services than the documentation clearly scopes.
Install only if you are comfortable sending selected media, prompts, task IDs, and some local path metadata to this third-party service. Use it only with non-sensitive videos from explicit paths or public URLs you trust; avoid private files, internal URLs, localhost URLs, cloud metadata addresses, and regulated or confidential recordings unless you have verified the provider's retention and data-handling practices.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/utils/validator.js:3- Finding
Server-Side Request Forgery Through Unrestricted URLs and Redirects
- Content
View full analysis
this.__opts.maxRedirects) { const err = new Error("Too many redirects"); this.__setState(this.__states.FAILED); this.emit("error", err); return reject(err); } const redirectedURL = /^https?:\/\//.test(response.headers.location) ? response.headers.location : new URL(response.headers.location, this.url).href; this.__isRedirected = true; this.__initProtocol(redirectedURL); this.emit("redirected", redirectedURL, this.url); return this.__start(); } ``` ### Technical Analysis The Skill validates only the URL scheme. It does not reject loopback, private, link-local, unique-local IPv6, multicast, or cloud metadata destinations. Hostnames are not resolved and checked before a connection is made. Redirect targets are also accepted without repeating a network-boundary validation. An apparently public URL can therefore redirect the downloader to an internal service. DNS rebinding can similarly cause a hostname that initially appears public to resolve to a prohibited internal address when the request is performed. The downloaded response is saved locally and subsequently uploaded to the external transcription service. This creates an exfiltration path for data retrieved from internal resources rather than merely allowing blind network probi ...[truncated 1455 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/utils/helper.js:27- Finding
Unbounded Downloads Permit Disk and Process Resource Exhaustion
- Content
View full analysis
{ const options = { retry: { maxRetries: constants.CREATE_MAX_ATTEMPTS, delay: constants.RETRY_INTERVAL, }, override: { skip: true, skipSmaller: true }, }; let progressLog = ""; const dl = new Downloader(url, path, options); ``` The downloader's default request timeout is disabled: ```js this.__defaultOpts = { body: null, retry: false, method: "GET", headers: {}, fileName: "", timeout: -1, metadata: null, override: false, forceResume: false, removeOnStop: true, removeOnFail: true, maxRedirects: 10, ``` The response is streamed directly to disk without a byte limit: ```js this.__fileStream = fs.createWriteStream(this.__filePath, {}); ``` ### Technical Analysis The downloader does not enforce a maximum accepted `Content-Length`, track downloaded bytes against a configured limit, or apply an overall operation deadline. Its default timeout is `-1`, and the caller does not override it. A malicious server can return an extremely large response, omit `Content-Length`, continuously stream data, or deliberately send data very slowly. Because the response is piped directly into a file, the process can consume all available disk space. A slow or endless response can also keep the Node.js process and associated resources occupied indefinitely. Retries can increase resource consumption when network failures are induced. The 24-hour cleanup mechanism does not mitigate an actively growing file or guarantee sufficient free space during the current execution. ### Attack Path 1. An attacker sup ...[truncated 940 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/api/video.js:11- Finding
Full Local Filesystem Paths Are Disclosed to the Remote API
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/utils/upload.js:10- Finding
Remote API Can Select an Unrestricted HTTPS Upload Destination
- Content
View full analysis
{ const fileStats = fs.statSync(filename); const totalSize = fileStats.size; let uploadedSize = 0; let settled = false; const fileStream = fs.createReadStream(filename); const uploadHeaders = Object.assign({}, headers); uploadHeaders["Content-Length"] = String(totalSize); if (!uploadHeaders["Content-Type"]) { uploadHeaders["Content-Type"] = "application/octet-stream"; } const options = { host: url.hostname, path: url.pathname + url.search, method: "PUT", headers: uploadHeaders, }; ``` ### Technical Analysis The presigning API controls the upload hostname, path, query string, and most request headers. The client verifies only that the URL uses HTTPS. It does not restrict the hostname to a documented object-storage provider, reject private or loopback destinations, or constrain which remote-supplied headers are forwarded. As a result, a compromised or malfunctioning API response can direct the client to upload the selected file to any HTTPS endpoint. This behavior also conflict ...[truncated 1218 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (17)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the implementation only validates the token and emits promotional or contact text instead of performing the declared transcription workflow, the skill is deceptive and may improperly collect secrets or mislead operators into granting sensitive credentials. In a security context, undisclosed credential gating plus nonfunctional behavior is dangerous because it can be used for phishing-like token harvesting or policy evasion.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the implementation only validates the token and emits promotional or contact text instead of performing the declared transcription workflow, the skill is deceptive and may improperly collect secrets or mislead operators into granting sensitive credentials. In a security context, undisclosed credential gating plus nonfunctional behavior is dangerous because it can be used for phishing-like token harvesting or policy evasion.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the implementation only validates the token and emits promotional or contact text instead of performing the declared transcription workflow, the skill is deceptive and may improperly collect secrets or mislead operators into granting sensitive credentials. In a security context, undisclosed credential gating plus nonfunctional behavior is dangerous because it can be used for phishing-like token harvesting or policy evasion.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the implementation only validates the token and emits promotional or contact text instead of performing the declared transcription workflow, the skill is deceptive and may improperly collect secrets or mislead operators into granting sensitive credentials. In a security context, undisclosed credential gating plus nonfunctional behavior is dangerous because it can be used for phishing-like token harvesting or policy evasion.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README explicitly promotes cloud-side processing of local files and public video links, but it does not give a prominent, upfront warning that uploaded videos leave the user's device and are sent to a remote third-party service for processing. Because videos may contain sensitive personal, corporate, or regulated data, insufficient disclosure can lead users to unknowingly transmit confidential content off-device.
- Content
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md 4. 同时传入文件路径与任务ID，优先执行 `--id`，忽略 `--file` 5. 无自定义 prompt 时，默认完整转录视频全部文字 | 用户自然语言指令 | 自动生成命令 | | -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 视频提取 https://example.com/video.mp4 中的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 把本地 /path/to/your/video.mp4 改成小红书风格的文案 | `node scripts/video2text/index.js --file "/path/to/your/video.mp4" --prompt "改写成小红书风格的文案"` |
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 80% confidence
- Finding
The skill declares use of an environment variable for authentication but does not define an explicit tool scope such as permissions or allowed-tools. In agent ecosystems, missing scope declarations can cause over-broad execution privileges or make it unclear what sensitive resources the skill may access, weakening review and policy enforcement.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The activation description is broad enough to trigger on common writing, summarization, and analysis requests that may not involve video transcription. Over-broad routing can cause unnecessary transmission of user files or content to an external service, creating avoidable privacy and data-minimization risks.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The 'when to use' section lists many broad content-production intents without strict trigger boundaries, increasing the chance the agent invokes this skill for unrelated tasks. Because the skill uploads user-provided media or fetches remote URLs, mistaken activation can expose data to third parties unnecessarily.
- Content
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md ## 6. 🧠 自然语言 → 命令 映射（AI 执行参考） | 用户自然语言指令 | 生成的命令 | | ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 提取 https://example.com/video.mp4 里的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This JavaScript file contains natural-language strings and comments in Chinese for download progress and error reporting, indicating the skill forces a specific language for user-visible output. The policy allows locale-specific behavior only when it is clearly justified or when the user is given a language/locale choice, neither of which is present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The code emits user-facing error strings entirely in Chinese, including operational guidance, with no indication that the skill is China-specific or that users can select another language. This can violate language/locale policy for general-purpose skills because it imposes a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill prints all user-facing warning and status messages in Chinese, including error and recovery instructions, with no indication that language is configurable or user-selected. This creates a locale policy issue because the skill imposes a specific language without opt-in or documented regional scope.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The comment makes a privacy and retention guarantee that the code does not enforce: this function only uploads a local video to a remote presigned URL and contains no deletion, lifecycle, or verification logic. In a skill handling user videos for transcription, this mismatch can mislead users and integrators into believing sensitive media is automatically deleted, creating privacy, compliance, and trust risks if the backend or storage retains the data longer than promised.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The banner text on L07 is hardcoded in Chinese, which imposes a specific language on users without any opt-in or indication that the skill is region-specific. The policy explicitly calls for flagging language or locale constraints when the skill does not offer a language choice or document a justified limitation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The description forces a specific language/locale in the skill metadata, which can conflict with language-choice policy when no opt-in or region-specific justification is provided. The file does not state that the skill is intended only for Chinese-speaking users or offer alternative language support.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This file presents all user-facing natural-language output, including errors, usage text, and help content, only in Chinese. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
- Content
Static analysis
No suspicious patterns detected.