Security audit

weibo-video-to-transcript

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent video transcription tool, but its URL downloading and remote upload handling create review-worthy privacy and network-safety risks.

Install only if you are comfortable sending selected videos and downloaded URL content to GuaiKei's cloud service and any storage endpoint it presigns. Avoid using it on confidential media or untrusted URLs until URL filtering, download size limits, media validation, and upload-host allowlisting are added.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/utils/validator.js:3
Finding: Unrestricted URL Downloads Permit Server-Side Request Forgery and Disk Exhaustion
Content: View full analysis
{ if (this.__isRequireRedirect(response)) { redirectCount++; if (redirectCount > this.__opts.maxRedirects) { const err = new Error("Too many redirects"); this.__setState(this.__states.FAILED); this.emit("error", err); return reject(err); } const redirectedURL = /^https?:\/\//.test(response.headers.location) ? response.headers.location : new URL(response.headers.location, url).href; this.emit("redirected", redirectedURL, url); return getRequest(redirectedURL, getReqOptions(redirectedURL)); } ``` ```javascript // scripts/utils/download.js:464-492 return this.__protocol.request(this.__reqOptions, (response) => { this.__response = response; if (!this.__isResumed) { this.__total = parseInt(response.headers["content-length"]) || null; this.__resetStats(); } if (this.__isRequireRedirect(response)) { this.__redirectCount++; if (this.__redirectCount > this.__opts.maxRedirects) { const err = new Error("Too many redirects"); this.__setState(this.__states.FAILED); this.emit("error", err); return reject(err); } const redirectedURL = /^https?:\/\//.test(response.headers.location) ? response.headers.location : new URL(response.headers.location, this.url).href; this.__isRedirected = true; this.__initProtocol(r ...[truncated 3561 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/utils/upload.js:11
Finding: API-Controlled Presigned Upload URL Is Not Restricted to Trusted Storage Hosts
Content: View full analysis
{ const fileStats = fs.statSync(filename); const totalSize = fileStats.size; ``` ```javascript // scripts/utils/upload.js:34-43 const options = { host: url.hostname, path: url.pathname + url.search, method: "PUT", headers: uploadHeaders, }; const req = https.request( { ...options, timeout: constants.REQUEST_TIMEOUT }, (res) => { ``` ### Technical Analysis The upload function confirms only that the API-provided URL uses HTTPS. It does not verify that the hostname belongs to an approved object-storage provider or service-controlled domain. The GuaiKei API therefore controls both the upload hostname and the headers sent with the upload. If that service is compromised, misconfigured, or returns an unexpected destination, the client will transmit the entire selected local file to any HTTPS server specified in the response. TLS protects the connection in transit but does not establish that the destination is authorized to receive the user's file. This behavior also conflicts with the documentation's assertion that the Skill communicates only with `www.guaikei.com`, because the implement ...[truncated 1153 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (21)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The finding indicates access to package metadata or unrelated local filesystem content beyond what users would expect from a video-transcription skill. Even if incidental, undeclared local file access increases the risk of unintended data exposure in an agent environment handling sensitive files.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The finding indicates access to package metadata or unrelated local filesystem content beyond what users would expect from a video-transcription skill. Even if incidental, undeclared local file access increases the risk of unintended data exposure in an agent environment handling sensitive files.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The finding indicates access to package metadata or unrelated local filesystem content beyond what users would expect from a video-transcription skill. Even if incidental, undeclared local file access increases the risk of unintended data exposure in an agent environment handling sensitive files.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The finding indicates access to package metadata or unrelated local filesystem content beyond what users would expect from a video-transcription skill. Even if incidental, undeclared local file access increases the risk of unintended data exposure in an agent environment handling sensitive files.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · README.md (reported line 99)May include surrounding context.
md
4. 同时传入文件路径与任务ID，优先执行 `--id`，忽略 `--file` 5. 无自定义 prompt 时，默认完整转录视频全部文字 | 用户自然语言指令 | 自动生成命令 | | -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 视频提取 https://example.com/video.mp4 中的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 把本地 /path/to/your/video.mp4 改成小红书风格的文案 | `node scripts/video2text/index.js --file "/path/to/your/video.mp4" --prompt "改写成小红书风格的文案"` |

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 80% confidence
Finding: The skill requires access to an API token via environment variables but does not declare any explicit tool scope or permission boundaries. In an agent ecosystem, missing scope declarations make it harder to enforce least privilege and to reason about what sensitive resources the skill may access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill processes local videos and URLs by uploading content to a remote cloud service, but that data-transfer fact is not made prominently clear up front. Users may unknowingly send sensitive or regulated media off-device, creating privacy, confidentiality, and compliance risk.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.
md
## 7. 🗣️ 自然语言 → 命令（照这张表转） | 用户说的话 | 就执行这条命令 | | ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | 提取 https://example.com/video.mp4 里的文字 | `node scripts/video2text/index.js --file "https://example.com/video.mp4"` | | 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The package description is entirely in Chinese and presents the skill's functionality and outputs in that language, including Chinese-specific content-generation scenarios, without indicating any user-selectable language or locale option. Under the policy for natural-language violations, forcing a specific language without opt-in is a reportable issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This file consistently uses Chinese-only natural-language strings in comments, error messages, and operation labels such as "预上传", "视频ID", and "视频文案". Under the stated policy, forcing a specific language without offering a user language/locale choice is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This JavaScript file contains all user-facing errors, comments, and generated help text exclusively in Chinese, including thrown error messages and the help banner. Under the language/locale policy rule, forcing a specific language without user opt-in or documented justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This JavaScript file contains multiple user-visible strings in Chinese, including status and error messages for download operations. Because the file does not offer a language/locale choice or indicate that the skill is intentionally region-specific, it violates the policy against forcing a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This code sends JSON data over HTTPS and includes a TOKEN header, but there is no confirmation prompt, user-facing disclosure, or warning in the file about transmitting user-provided data and credentials to a remote service. Because this is a code file, network transmission of data is in scope when it lacks any visible disclosure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file emits all user-facing status and warning text in Chinese only, including the token configuration warning and promotional guidance. This imposes a specific language on users without any opt-in, fallback, or indication that the skill is intentionally limited to a Chinese-speaking context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This file contains natural-language content exclusively in Chinese, including the doc comment and multiple thrown or logged messages. The file does not indicate that the skill is region-specific or that users can opt into this locale, which can violate an organizational language/locale policy requiring choice or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README content, usage instructions, warnings, and examples are all presented in Chinese, and the file does not indicate that users may choose another language or locale. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is in scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The skill documentation and prompt templates are entirely framed in Chinese and direct transformations into Chinese platform styles such as 小红书、抖音、公众号, while not stating that the skill is China-specific or offering a language preference choice. Under the policy, a skill should not implicitly force a specific language or locale unless the constraint is explicit and justified or the user can opt in.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: L185 says TOKEN-related failures should show a neutral error message without marketing copy, contact details, or website links. However, the surrounding documentation repeatedly embeds the official website and WeChat contact as the prescribed token acquisition path, creating an intent/documentation inconsistency about whether token errors should remain non-promotional.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file contains multiple user-visible error messages in Chinese, including operational guidance, with no indication that the skill is intentionally limited to Chinese-speaking users or that language is configurable. This can violate language/locale policy when a specific language is imposed without opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file prints a fixed Chinese title string to users, which imposes a specific language in the skill's interface. Under the policy, language forcing without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code file contains user-facing descriptions and help examples entirely in Chinese, and later runtime messages are also Chinese-only. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.