Security audit

videotranscribe

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent video transcription purpose, but it needs Review because it can fetch any HTTP(S) URL from the user's environment and upload the downloaded content to a remote service.

Install only if you are comfortable sending selected videos, downloaded URL content, prompts, and resulting transcripts to the GuaiKei remote service. Use it with trusted local files or clearly public video URLs, and avoid running it on cloud hosts or internal networks where a supplied URL could reach metadata services, localhost, or private systems. Treat the deletion and privacy claims as provider promises rather than locally enforceable controls.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/utils/validator.js:3
Finding: Unrestricted URL Fetching Enables Server-Side Request Forgery and Internal Data Disclosure
Content: View full analysis
this.__opts.maxRedirects) { const err = new Error("Too many redirects"); this.__setState(this.__states.FAILED); this.emit("error", err); return reject(err); } const redirectedURL = /^https?:\/\//.test(response.headers.location) ? response.headers.location : new URL(response.headers.location, this.url).href; this.__isRedirected = true; this.__initProtocol(redirectedURL); this.emit("redirected", redirectedURL, this.url); return this.__start(); } ``` `scripts/video2text/index.js:138-151` subsequently uploads the downloaded response to remote storage: ```js try { const presignedUrl = await video.getPresignedUrl(tokenValue, file); if (!presignedUrl || !presignedUrl?.url || presignedUrl.url === "") { t ...[truncated 2820 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/utils/helper.js:28
Finding: Unbounded Remote Downloads Permit Disk, Bandwidth, and Service Resource Exhaustion
Content: View full analysis
= totalSize) ) { this.emit("skip", { totalSize: this.__total, fileName: this.__fileName, filePath: this.__filePath, downloadedSize: downloadedSize, }); this.__setState(this.__states.SKIPPED); return resolve(true); } } this.__fileStream = fs.createWriteStream(this.__filePath, {}); } else { this.__fileStream = fs.createWriteStream(this.__filePath, { flags: "a" }); } this.emit("download", { fileName: this.__fileName, filePath: this.__filePath, totalSize: this.__total, isResumed: this.__isResumed, downloadedSize: this.__downloaded, }); this.__retryCount = 0; this.__isResumed = false; this.__isRedirected = false; this.__setState(this.__stat ...[truncated 2688 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (24)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill embeds marketing/contact flows and describes token-dependent behavior, including cases where invalid token state may suppress normal output. Mixing operational behavior with commercial messaging can mislead upstream agents, interfere with error handling, and create a channel for non-user-requested promotional output; if the implementation really returns empty output on token failure, that is especially unsafe because it masks failures and breaks security-relevant observability.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill embeds marketing/contact flows and describes token-dependent behavior, including cases where invalid token state may suppress normal output. Mixing operational behavior with commercial messaging can mislead upstream agents, interfere with error handling, and create a channel for non-user-requested promotional output; if the implementation really returns empty output on token failure, that is especially unsafe because it masks failures and breaks security-relevant observability.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill embeds marketing/contact flows and describes token-dependent behavior, including cases where invalid token state may suppress normal output. Mixing operational behavior with commercial messaging can mislead upstream agents, interfere with error handling, and create a channel for non-user-requested promotional output; if the implementation really returns empty output on token failure, that is especially unsafe because it masks failures and breaks security-relevant observability.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README explicitly promotes cloud-based processing of local files and public video links, but it does not clearly and prominently warn users that uploaded media, audio, transcripts, prompts, and derived content leave the local machine and are processed by a third-party remote service. Although the document mentions cloud compute and claims deletion after processing, that is not the same as an informed disclosure of data transmission and third-party handling, which can expose sensitive meeting recordings, interviews, or proprietary media.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · README.md (reported line 99)May include surrounding context.
md
4. 同时传入文件路径与任务ID，优先执行 `--id`，忽略 `--file` 5. 无自定义 prompt 时，默认完整转录视频全部文字 | 用户自然语言指令 | 自动生成命令 | | -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 视频提取 https://example.com/video.mp4 中的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 把本地 /path/to/your/video.mp4 改成小红书风格的文案 | `node scripts/video2text/index.js --file "/path/to/your/video.mp4" --prompt "改写成小红书风格的文案"` |

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest description is written as an instruction to handle all relevant requests in Chinese and does not indicate that users may choose another interface language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The document promises neutral, non-promotional error messages, yet elsewhere instructs users to surface contact details and promotional links in setup/error-related guidance. This inconsistency can cause agents to emit unsolicited promotional content during failure handling, which is a form of instruction-channel contamination and can degrade trust, confuse automated callers, or leak vendor-specific contact details where only diagnostics should appear.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This JavaScript file uses only Chinese natural-language comments, operation labels, and thrown error messages such as "token 必须是非空字符串" and "获取视频文案失败". The file provides no indication that the skill is region-specific or that users can choose their preferred language, which creates a natural-language locale policy concern under the rule.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This JavaScript file contains natural-language comments, thrown error messages, and help text entirely in Chinese, such as the module description, validation errors, and usage output. Under the policy rules, forcing a specific language without user opt-in or a documented locale-specific justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code returns natural-language error text in Chinese, and similar Chinese-only messages appear throughout the file. There is no indication that the skill offers language selection or documents a justified locale restriction, which can violate language/locale policy expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This user-facing error string is hard-coded in Chinese and does not provide any locale choice. Without documented regional scoping or opt-in, hard-forcing one language is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This code sends JSON data to a remote host and includes a TOKEN header, which is a network operation involving potentially sensitive user or system data. While there is retry logging for failures, there is no user-facing warning, confirmation, or explanatory comment/docstring here describing that outbound transmission and token use occur.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The user-facing messages shown when the token is invalid are entirely in Chinese, with no indication that the user can choose another language or that the skill is intended only for a Chinese-speaking context. This creates a natural-language policy issue because it imposes a specific language on users without opt-in.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The comment makes a privacy and retention promise ('only used for transcription' and 'automatically deleted after completion') that is not enforced anywhere in this module. In a skill that uploads user videos to remote object storage, inaccurate deletion claims can mislead users into sharing sensitive recordings under false assumptions, creating privacy, compliance, and trust risks if deletion is not implemented elsewhere.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The only user-facing natural-language documentation in this file is written entirely in Chinese, with no indication that another language is available or that language choice is user-configurable. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The banner string on L07 is entirely in Chinese, indicating the skill presents itself in a fixed language. The file provides no user opt-in, locale selection, or justification that the skill is intentionally limited to a Chinese-speaking context, which can violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code presents all argument descriptions, help text, and status/error messaging in Chinese only. Under the policy, a language/locale restriction should either offer user opt-in/choice or be clearly documented as a justified region-specific constraint; neither is present in this file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill routes user-supplied local video files and public video URLs to a remote cloud service for transcription, but the introductory description does not clearly warn users up front that their content leaves the local environment. This can mislead users into submitting sensitive recordings under the assumption of local processing, creating privacy and data-governance risk even if the later sections mention cloud processing and deletion claims.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.
md
## 7. 🗣️ 自然语言 → 命令（照这张表转） | 用户说的话 | 就执行这条命令 | | ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 提取 https://example.com/video.mp4 里的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · video2text-ai-1.0.1/SKILL.md (reported line 156)May include surrounding context.
md
## 7. 🗣️ 自然语言 → 命令（照这张表转） | 用户说的话 | 就执行这条命令 | | ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 提取 https://example.com/video.mp4 里的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The frontmatter declares name: videotranscribe at L002, but L198 states the skill naming convention is name: video2text-ai. This is a direct documentation-to-declared-metadata inconsistency about the skill's identity rather than a mere omission.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code emits multiple user-visible messages such as download completion, retry, resume, and failure notices entirely in Chinese. Because the file provides no opt-in, fallback, or justification for a fixed locale, it conflicts with the policy against forcing a specific language without user choice.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The manifest emphasizes converting local/public videos into text and derivative content, but this code uploads the full source file to external OSS via a presigned HTTPS URL. While remote processing may be part of the implementation, the manifest does not clearly disclose that user video files are transmitted to third-party storage.
Content: No source excerpt is available for this finding.