Security audit

generate-video

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Flyelep video-generation API helper, but it can upload user media to permanent public links and gives unsafe shell-style examples for secrets and JSON payloads.

Review before installing. Only use this skill with media you are comfortable uploading to Flyelep and potentially exposing through long-lived public URLs. Avoid confidential, personal, biometric, customer, or unreleased business media unless the service gives you separate retention and deletion guarantees. Prefer an implementation that uses structured HTTP requests, redacts the API key, serializes JSON safely, and asks before every upload.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:231
Finding: Permanent Public Exposure of Uploaded User Media
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:264
Finding: API Secret Exposed Through Command-Line Arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:277
Finding: Shell Command Injection Through Inline User-Controlled JSON
Content: View full analysis
- **macOS/Linux**：bash/zsh 默认 UTF-8，可直接内联 JSON：`curl -X POST URL -H "Content-Type: application/json; charset=utf-8" -H "secretKey: 你的密钥" --data-binary 'JSON单行内容'` ``` ```bash curl -X POST "https://www.flyelep.cn/prod-api/poster-design/api/v1/poster/generateVideo" -H "Content-Type: application/json; charset=utf-8" -H "secretKey: 你的密钥" --max-time 120 --data-binary '{"query":"为这款智能手表制作一个展示视频，突出运动监测功能","platformType":"Amazon","languageType":"英语","videoModelType":"pro","aspectRatio":"16:9","needVoice":true,"duration":10,"resolution":"720p","videoTag":"主图视频"}' ``` Equivalent inline JSON construction is repeated at lines 396, 437, and 482. ### Technical Analysis The `query` field contains user-controlled text, and other request fields may also be derived from user input. The macOS/Linux examples place the complete JSON document inside a single-quoted shell argument without requiring structured JSON serialization or shell-safe argument construction. If an implementation follows this pattern by concatenating raw input, a single quote in user-controlled content can terminate the quoted JSON argument. The remaining input can then introduce shell operators or additional commands. Merely validating the JSON after concatenation is insufficient because the shell interprets the command before `curl` receives the payload. The Windows examples use a temporary payload file and are less directly exposed to this specific shell-quoting issue, although safe JSON serialization and secure temporary-file handling are still necessary. ### Attack Path 1. An attacker provides a video prompt or another request value containing a single quote followed by shell syntax. 2. The agent interpolates the value into the documented inline JSON command. 3. The injected quote closes the shell's single-qu ...[truncated 1076 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill does not provide a clear user-facing warning that local files and media URLs will be transmitted to Flyelep and that uploaded outputs may be permanent public links. This undermines informed consent and can lead users to disclose sensitive media, proprietary assets, or internal URLs without understanding the persistence and third-party exposure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The skill description and operating instructions are entirely in Chinese, and the parameter section restricts languageType support to 英语 and 中文简体. There is no stated user choice for the skill's own interaction language or policy justification for limiting supported languages, which can violate language/locale choice expectations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The activation text says to use this skill whenever the user asks to generate a video, AI-generate a video, text-to-video, or generate from a description. These phrases are broad and likely to match many ordinary requests, but the file does not provide negative examples or clear boundaries for when this specific Flyelep API skill should or should not be invoked.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill includes a built-in local file upload path that sends user-supplied media to Flyelep infrastructure before video generation. This is dangerous because it expands the data-transfer scope beyond text prompts and can cause unintended disclosure of local files to a third party, especially when uploads result in permanent public links.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 96% confidence
Finding: The skill explicitly instructs external transmission of local media files to a third-party endpoint. In context, that behavior is part of the intended functionality, but it remains security-relevant because it moves potentially sensitive local content off-device and to remote storage controlled by another service.
Content: Scanner excerpt · SKILL.md (reported line 263)May include surrounding context.
判断成功只看 code，业务失败时 HTTP 状态码仍是 200，code 为 500 或 9999，原因在 msg 里。

bash
# Windows/PowerShell（用 curl.exe，PowerShell 里的 curl 是 Invoke-WebRequest 的别名） curl.exe -X POST "https://www.flyelep.cn/prod-api/poster-design/api/v1/file/upload" -H "secretKey: 你的密钥" --max-time 300 -F "file=@C:/path/to/reference.mp4" # macOS/Linux

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill instructs creating temporary payload files on disk and later deleting them, which can leave sensitive request contents behind if cleanup fails or the file is written to an insecure location. Because these payloads may include user prompts, task identifiers, and operational metadata, they increase local data exposure and forensic residue risk.
Content: No source excerpt is available for this finding.