Security audit

videotranscribe

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent video transcription purpose, but it needs Review because it can fetch any HTTP(S) URL from the user's environment and upload the downloaded content to a remote service.

Install only if you are comfortable sending selected videos, downloaded URL content, prompts, and resulting transcripts to the GuaiKei remote service. Use it with trusted local files or clearly public video URLs, and avoid running it on cloud hosts or internal networks where a supplied URL could reach metadata services, localhost, or private systems. Treat the deletion and privacy claims as provider promises rather than locally enforceable controls.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/utils/validator.js:3
Finding: Unrestricted URL Fetching Enables Server-Side Request Forgery and Internal Data Disclosure<![CDATA[ ## Vulnerability Details **File Location**: `scripts/utils/validator.js:3-7`, `scripts/video2text/index.js:101-109`, `scripts/utils/download.js:482-493`, `scripts/video2text/index.js:138-151` **Vulnerability Type**: Server-Side Request Forgery (SSRF) with remote data exfiltration **Risk Level**: High ### Vulnerable Code `scripts/utils/validator.js:3-7` only verifies that the input uses HTTP or HTTPS: ```js function isUrl(url) { try { const parsedUrl = new URL(url); return parsedUrl.protocol === "http:" || parsedUrl.protocol === "https:"; } catch (_) { return false; } } ``` `scripts/video2text/index.js:101-109` passes the accepted URL directly to the downloader: ```js if (validator.isUrl(file)) { const filepath = utils.downloadPath(); try { await fs.promises.mkdir(filepath, { recursive: true }); } catch (error) { utils.printError("临时下载目录创建失败: " + (error.message || String(error))); process.exit(1); } try { const downloadResult = await helper.download(file, filepath); ``` `scripts/utils/download.js:482-493` follows redirects without validating the new destination: ```js if (this.__isRequireRedirect(response)) { this.__redirectCount++; if (this.__redirectCount > this.__opts.maxRedirects) { const err = new Error("Too many redirects"); this.__setState(this.__states.FAILED); this.emit("error", err); return reject(err); } const redirectedURL = /^https?:\/\//.test(response.headers.location) ? response.headers.location : new URL(response.headers.location, this.url).href; this.__isRedirected = true; this.__initProtocol(redirectedURL); this.emit("redirected", redirectedURL, this.url); return this.__start(); } ``` `scripts/video2text/index.js:138-151` subsequently uploads the downloaded response to remote storage: ```js try { const presignedUrl = await video.getPresignedUrl(tokenValue, file); if (!presignedUrl || !presignedUrl?.url || presignedUrl.url === "") { t ...[truncated 2820 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Reject non-public destinations before opening a connection: - Resolve all hostname A and AAAA records. - Reject loopback, private, link-local, multicast, unspecified, reserved, and documentation ranges. - Explicitly block cloud metadata addresses, including `169.254.169.254` and relevant IPv6 equivalents. 2. Repeat the complete validation procedure for every redirect destination. 3. Prevent DNS rebinding by connecting to the already validated IP address while preserving the intended TLS server name and HTTP `Host` value. 4. Consider an allowlist of supported public video platforms and approved content-delivery domains. 5. Reject URLs containing embedded credentials unless they are explicitly required. 6. Apply the same controls to both HTTP and HTTPS destinations. 7. Where practical, run the downloader in a restricted network environment that cannot reach private networks, local control planes, or metadata services. 8. Add automated tests covering direct private IPs, encoded IP representations, IPv6 local addresses, public-to-private redirects, multi-record DNS responses, and DNS rebinding scenarios. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/utils/helper.js:28
Finding: Unbounded Remote Downloads Permit Disk, Bandwidth, and Service Resource Exhaustion<![CDATA[ ## Vulnerability Details **File Location**: `scripts/utils/helper.js:28-39`, `scripts/utils/download.js:465-469`, `scripts/utils/download.js:541-569` **Vulnerability Type**: Uncontrolled resource consumption through unbounded remote download **Risk Level**: Medium ### Vulnerable Code `scripts/utils/helper.js:28-39` initializes the downloader without a maximum file size or overall deadline: ```js const options = { retry: { maxRetries: constants.CREATE_MAX_ATTEMPTS, delay: constants.RETRY_INTERVAL, }, override: { skip: true, skipSmaller: true }, }; let progressLog = ""; const dl = new Downloader(url, path, options); ``` `scripts/utils/download.js:465-469` permits responses with a missing or invalid `Content-Length`: ```js if (!this.__isResumed) { this.__total = parseInt(response.headers["content-length"]) || null; this.__resetStats(); } ``` `scripts/utils/download.js:541-569` streams the response to disk without enforcing a byte limit: ```js if (fs.existsSync(this.__filePath)) { const downloadedSize = this.__getFilesizeInBytes(this.__filePath); const totalSize = this.__total ? this.__total : 0; if ( typeof this.__opts.override === "object" && this.__opts.override.skip && (this.__opts.override.skipSmaller || downloadedSize >= totalSize) ) { this.emit("skip", { totalSize: this.__total, fileName: this.__fileName, filePath: this.__filePath, downloadedSize: downloadedSize, }); this.__setState(this.__states.SKIPPED); return resolve(true); } } this.__fileStream = fs.createWriteStream(this.__filePath, {}); } else { this.__fileStream = fs.createWriteStream(this.__filePath, { flags: "a" }); } this.emit("download", { fileName: this.__fileName, filePath: this.__filePath, totalSize: this.__total, isResumed: this.__isResumed, downloadedSize: this.__downloaded, }); this.__retryCount = 0; this.__isResumed = false; this.__isRedirected = false; this.__setState(this.__stat ...[truncated 2688 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Define a strict, configurable maximum download size appropriate for supported videos. 2. Reject responses whose declared `Content-Length` exceeds that limit. 3. Count bytes while streaming and immediately abort the request and destroy the output file once the limit is exceeded, regardless of the declared length. 4. Apply a maximum total transfer duration in addition to socket inactivity timeouts. 5. Validate `Content-Type` against an allowlist of supported video or audio media types. 6. Verify the downloaded file using trusted media parsing or file-signature inspection before uploading it. 7. Check available filesystem capacity before and during downloads, preserving a safe minimum free-space threshold. 8. Enforce a separate upload-size limit to prevent large local files from consuming outbound resources. 9. Delete partial files in a `finally` block after failed, aborted, or oversized transfers. 10. Place temporary downloads on a filesystem with an explicit quota and restrictive permissions. 11. Add tests for missing, malformed, false, and oversized `Content-Length` headers, endless chunked streams, slow continuous streams, and non-media content. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (24)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill embeds marketing/contact flows and describes token-dependent behavior, including cases where invalid token state may suppress normal output. Mixing operational behavior with commercial messaging can mislead upstream agents, interfere with error handling, and create a channel for non-user-requested promotional output; if the implementation really returns empty output on token failure, that is especially unsafe because it masks failures and breaks security-relevant observability.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill embeds marketing/contact flows and describes token-dependent behavior, including cases where invalid token state may suppress normal output. Mixing operational behavior with commercial messaging can mislead upstream agents, interfere with error handling, and create a channel for non-user-requested promotional output; if the implementation really returns empty output on token failure, that is especially unsafe because it masks failures and breaks security-relevant observability.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill embeds marketing/contact flows and describes token-dependent behavior, including cases where invalid token state may suppress normal output. Mixing operational behavior with commercial messaging can mislead upstream agents, interfere with error handling, and create a channel for non-user-requested promotional output; if the implementation really returns empty output on token failure, that is especially unsafe because it masks failures and breaks security-relevant observability.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README explicitly promotes cloud-based processing of local files and public video links, but it does not clearly and prominently warn users that uploaded media, audio, transcripts, prompts, and derived content leave the local machine and are processed by a third-party remote service. Although the document mentions cloud compute and claims deletion after processing, that is not the same as an informed disclosure of data transmission and third-party handling, which can expose sensitive meeting recordings, interviews, or proprietary media.

Whitespace Padding

Medium

Category: Prompt Injection
Content: 4. 同时传入文件路径与任务ID，优先执行 `--id`，忽略 `--file` 5. 无自定义 prompt 时，默认完整转录视频全部文字 | 用户自然语言指令 | 自动生成命令 | | -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 视频提取 https://example.com/video.mp4 中的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 把本地 /path/to/your/video.mp4 改成小红书风格的文案 | `node scripts/video2text/index.js --file "/path/to/your/video.mp4" --prompt "改写成小红书风格的文案"` |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The manifest description is written as an instruction to handle all relevant requests in Chinese and does not indicate that users may choose another interface language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Intent-Code Divergence

Medium

Confidence: 83% confidence
Finding: The document promises neutral, non-promotional error messages, yet elsewhere instructs users to surface contact details and promotional links in setup/error-related guidance. This inconsistency can cause agents to emit unsolicited promotional content during failure handling, which is a form of instruction-channel contamination and can degrade trust, confuse automated callers, or leak vendor-specific contact details where only diagnostics should appear.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: This JavaScript file uses only Chinese natural-language comments, operation labels, and thrown error messages such as "token 必须是非空字符串" and "获取视频文案失败". The file provides no indication that the skill is region-specific or that users can choose their preferred language, which creates a natural-language locale policy concern under the rule.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: This JavaScript file contains natural-language comments, thrown error messages, and help text entirely in Chinese, such as the module description, validation errors, and usage output. Under the policy rules, forcing a specific language without user opt-in or a documented locale-specific justification is a natural-language policy violation.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The code returns natural-language error text in Chinese, and similar Chinese-only messages appear throughout the file. There is no indication that the skill offers language selection or documents a justified locale restriction, which can violate language/locale policy expectations.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: This user-facing error string is hard-coded in Chinese and does not provide any locale choice. Without documented regional scoping or opt-in, hard-forcing one language is a natural-language policy concern.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: This code sends JSON data to a remote host and includes a TOKEN header, which is a network operation involving potentially sensitive user or system data. While there is retry logging for failures, there is no user-facing warning, confirmation, or explanatory comment/docstring here describing that outbound transmission and token use occur.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The user-facing messages shown when the token is invalid are entirely in Chinese, with no indication that the user can choose another language or that the skill is intended only for a Chinese-speaking context. This creates a natural-language policy issue because it imposes a specific language on users without opt-in.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The comment makes a privacy and retention promise ('only used for transcription' and 'automatically deleted after completion') that is not enforced anywhere in this module. In a skill that uploads user videos to remote object storage, inaccurate deletion claims can mislead users into sharing sensitive recordings under false assumptions, creating privacy, compliance, and trust risks if deletion is not implemented elsewhere.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The only user-facing natural-language documentation in this file is written entirely in Chinese, with no indication that another language is available or that language choice is user-configurable. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The banner string on L07 is entirely in Chinese, indicating the skill presents itself in a fixed language. The file provides no user opt-in, locale selection, or justification that the skill is intentionally limited to a Chinese-speaking context, which can violate language/locale policy requirements.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: This code presents all argument descriptions, help text, and status/error messaging in Chinese only. Under the policy, a language/locale restriction should either offer user opt-in/choice or be clearly documented as a justified region-specific constraint; neither is present in this file.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill routes user-supplied local video files and public video URLs to a remote cloud service for transcription, but the introductory description does not clearly warn users up front that their content leaves the local environment. This can mislead users into submitting sensitive recordings under the assumption of local processing, creating privacy and data-governance risk even if the later sections mention cloud processing and deletion claims.

Whitespace Padding

Medium

Category: Prompt Injection
Content: ## 7. 🗣️ 自然语言 → 命令（照这张表转） | 用户说的话 | 就执行这条命令 | | ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 提取 https://example.com/video.mp4 里的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: ## 7. 🗣️ 自然语言 → 命令（照这张表转） | 用户说的话 | 就执行这条命令 | | ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 提取 https://example.com/video.mp4 里的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Intent-Code Divergence

Low

Confidence: 95% confidence
Finding: The frontmatter declares `name: videotranscribe` at L002, but L198 states the skill naming convention is `name: video2text-ai`. This is a direct documentation-to-declared-metadata inconsistency about the skill's identity rather than a mere omission.

Natural-Language Policy Violations

Low

Confidence: 95% confidence
Finding: This code emits multiple user-visible messages such as download completion, retry, resume, and failure notices entirely in Chinese. Because the file provides no opt-in, fallback, or justification for a fixed locale, it conflicts with the policy against forcing a specific language without user choice.

Description-Behavior Mismatch

Low

Confidence: 79% confidence
Finding: The manifest emphasizes converting local/public videos into text and derivative content, but this code uploads the full source file to external OSS via a presigned HTTPS URL. While remote processing may be part of the implementation, the manifest does not clearly disclose that user video files are transmitted to third-party storage.

Static analysis

No suspicious patterns detected.