Security audit

videodictation

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to provide the advertised video-to-text service, but it needs review because it can fetch arbitrary URLs from the user’s environment and uploads video data and some local path metadata to a third-party service.

Install only if you are comfortable sending videos and prompts to guaikei.com and with the tool fetching URLs from the machine where the agent runs. Avoid sensitive, regulated, private-network, localhost, metadata-service, or very large URLs; prefer local files you intentionally choose, and assume full local path names may be visible to the service.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/utils/validator.js:3
Finding: Unrestricted URL Downloading Enables Server-Side Request Forgery and Resource Exhaustion
Content: View full analysis
{ const options = { retry: { maxRetries: constants.CREATE_MAX_ATTEMPTS, delay: constants.RETRY_INTERVAL, }, override: { skip: true, skipSmaller: true }, }; let progressLog = ""; const dl = new Downloader(url, path, options); ``` ### Technical Analysis The URL validator only confirms that the input parses as an HTTP or HTTPS URL. It does not resolve and inspect the destination address, restrict destination hosts, or reject loopback, private, link-local, multicast, and cloud metadata address ranges. The accepted URL is passed directly to the downloader. The reviewed configuration also does not impose a maximum response size. Consequently, any party able to influence the `--file` argument c ...[truncated 2037 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/api/video.js:11
Finding: Full Local File Paths Are Disclosed to the Remote API
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill accepts arbitrary http(s) URLs and documents downloading remote content into a local tmp directory before upload, but its top-level description frames the feature as video transcription without clearly scoping or warning about generic remote fetch behavior. This creates SSRF-like and unsafe-download risk in agent environments, especially if internal URLs, oversized files, or deceptive content types are supplied.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill accepts arbitrary http(s) URLs and documents downloading remote content into a local tmp directory before upload, but its top-level description frames the feature as video transcription without clearly scoping or warning about generic remote fetch behavior. This creates SSRF-like and unsafe-download risk in agent environments, especially if internal URLs, oversized files, or deceptive content types are supplied.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill accepts arbitrary http(s) URLs and documents downloading remote content into a local tmp directory before upload, but its top-level description frames the feature as video transcription without clearly scoping or warning about generic remote fetch behavior. This creates SSRF-like and unsafe-download risk in agent environments, especially if internal URLs, oversized files, or deceptive content types are supplied.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README's usage section instructs users to submit local video files and public video URLs to a remote cloud transcription service, but it does not place an explicit warning alongside those commands that the content will be uploaded off-device for third-party processing. Because videos may contain sensitive personal, business, or copyrighted material, users could unknowingly transmit data they did not intend to share, creating privacy and compliance risk.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · README.md (reported line 99)May include surrounding context.
md
4. 同时传入文件路径与任务ID，优先执行 `--id`，忽略 `--file` 5. 无自定义 prompt 时，默认完整转录视频全部文字 | 用户自然语言指令 | 自动生成命令 | | -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 视频提取 https://example.com/video.mp4 中的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 把本地 /path/to/your/video.mp4 改成小红书风格的文案 | `node scripts/video2text/index.js --file "/path/to/your/video.mp4" --prompt "改写成小红书风格的文案"` |

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The top-level description is entirely in Chinese and presents the skill's behavior, triggers, and outputs without offering a user language choice. Under the stated policy, forcing a specific language without explicit user opt-in is a natural-language policy concern unless the locale constraint is clearly documented and justified, which it is not here.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill sends user-provided local videos or fetched public-link content to a cloud service for processing, yet the warning is not presented prominently at the point of use. This weakens informed consent and can lead users to upload sensitive recordings or internal media without realizing third-party transfer occurs.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: L122 明确写到“错误提示中性，不夹带营销文案、联系方式或官网链接”，并在 L268 再次要求 TOKEN 错误时不得附带营销或联系方式。但同一技能文档在 L103 和 L268-L293 一带明确引导用户去官网和微信开通/联系，这与其宣称的错误处理意图直接冲突，构成文档层面的意图不一致。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This JavaScript file contains user-visible strings and documentation entirely in Chinese, including thrown error messages and operation labels. Under the policy rule, forcing a specific language without user opt-in or a documented regional justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This JavaScript file contains multiple natural-language strings and comments in Chinese, including status and error messages shown to users during downloads. The skill does not offer a language/locale option or document that it is intentionally region-specific, which creates a language-policy concern under the locale-choice rule.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code returns user-facing error text in Chinese, which imposes a specific language choice in natural-language strings. The file does not offer any locale selection or indicate that the skill is intentionally region-specific, so this is a language policy violation under the stated rules.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The authentication failure message is presented only in Chinese and includes operational guidance, making the language constraint especially visible to users. Because no opt-in or documented locale limitation is present in this file, this violates the natural-language language/locale policy.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This code emits all user-facing warning and status messages in Chinese, including promotional and recovery instructions, with no indication that the user can choose another language. That is a natural-language locale policy concern because it imposes a specific language on all users without opt-in or documented regional justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The banner string is hard-coded in Chinese, which imposes a specific language on users rather than allowing locale selection or user opt-in. This matches the policy category for language or locale constraints that are not explicitly optional or justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill prominently markets video-to-text capabilities but does not provide a clear up-front warning that local files or remote video content are uploaded to a third-party service for processing. This can cause users to submit sensitive recordings, meetings, interviews, or internal media without understanding the data transfer, retention, and third-party processing implications.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill claims it only communicates with guaikei.com, yet it also accepts arbitrary public video URLs and states that remote videos are downloaded into a tmp directory before upload. That mismatch can mislead users and agents about what network access occurs and what third-party hosts their content is fetched from, weakening informed consent and increasing SSRF-like or unexpected egress risk if URL handling is not tightly constrained in implementation.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.
md
## 7. 🗣️ 自然语言 → 命令（照这张表转） | 用户说的话 | 就执行这条命令 | | ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 提取 https://example.com/video.mp4 里的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · video2text-ai-1.0.1/SKILL.md (reported line 156)May include surrounding context.
md
## 7. 🗣️ 自然语言 → 命令（照这张表转） | 用户说的话 | 就执行这条命令 | | ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 提取 https://example.com/video.mp4 里的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: L198 声称技能命名为 video2text-ai 且与技能包目录一致，但实际 frontmatter 中的名称是 videodictation（L002）。这是文档对技能标识的主动陈述与实际声明不符，属于意图/文档与实际内容不一致。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This code file contains natural-language comments and user-visible error/help text in Chinese, indicating the skill experience is fixed to a specific language. Under the policy, forcing a specific language without user opt-in or justification is a locale-policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Multiple thrown errors, warnings, and generated help text are presented only in Chinese, affecting the runtime user interface of the skill. Because no language choice or explicit locale justification is present, this is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill is described as converting videos to text and generating derivative text outputs, but this helper hardcodes a vendor-specific token name and even a personal contact number in authentication failure messages. That capability is not necessary to implement video transcription itself and suggests coupling to an external service/support workflow beyond the manifest's stated user-facing purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The user-facing descriptions, examples, and operational messages in this file are written only in Chinese, including help output and flag documentation. That creates a language-specific constraint without any visible opt-in or alternative locale, which matches the natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The documentation says error messages should be neutral and should not include marketing copy, contact details, or website links. However, nearby setup/error-related sections include the vendor website and WeChat contact information, which undermines that stated intent and creates a contradiction in the documented behavior expectations.
Content: No source excerpt is available for this finding.