motion-reels-f100k

• Outcome: Review
• Latest audit: Sep 17, 2026 · 4:20 PM UTC
• Version: 1.0.0

Overview

The skill mostly matches a reel-overlay workflow, but it asks for persistent system installs, local secret-file access, third-party transcript calls, and includes conflicting instructions about whether it should edit/render final videos.

Install only if you are comfortable with a skill that can run shell commands, install or relink system tools, use unpinned npm/uvx packages, read an API key from a local secret file, and send remote video URLs to Supadata. Prefer running it in a contained environment, provide secrets only through environment variables, and require explicit approval before installs, external transcript calls, cutting, rendering, or composing video.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (25)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: La descripción declara un sistema integral de diseño de motion graphics para reels, con análisis visual, clasificación semántica del guion, selección entre varios formatos de tarjeta y entregables de producción. El código proporcionado no realiza nada de eso: solo genera HTML/GSAP para mostrar una frase palabra por palabra con animación cinética. Aunque la descripción menciona 'frases → kinetic', este fragmento cubre únicamente esa pieza específica y no representa la funcionalidad principal declarada ni los entregables anunciados. Por tanto, hay una discrepancia material entre la descripción amplia y el comportamiento real del código mostrado.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The manifest says the agent does not edit or compose video, yet the documented workflow includes video cutting and mutation of the source processing path. This discrepancy can cause an agent or operator to perform destructive or out-of-scope media transformations they did not consent to, undermining policy boundaries and user expectations.

Credential Access

High

• Category: Privilege Escalation

Content

#### Fuente remota (YouTube / Instagram / TikTok) → Supadata API

```bash
[ -z "$SUPADATA_API_KEY" ] && [ -f "$HOME/.config/f100k/secrets.env" ] && set -a && . "$HOME/.config/f100k/secrets.env" && set +a
curl -s "https://api.supadata.ai/v1/transcript?url=ENCODED_URL&lang=es" \
  -H "x-api-key: $SUPADATA_API_KEY" \
  | python3 -c "

• Confidence: 96% confidence
• Finding: The skill instructs loading credentials from `~/.config/f100k/secrets.env`, which is a direct secret-access pattern. In an agent environment, encouraging reads from local secret stores is dangerous because a compromised or overly broad workflow could expose API keys to logs, downstream commands, or untrusted outputs.

External Script Fetching

High

• Category: Supply Chain

Content

```bash
[ -z "$SUPADATA_API_KEY" ] && [ -f "$HOME/.config/f100k/secrets.env" ] && set -a && . "$HOME/.config/f100k/secrets.env" && set +a
curl -s "https://api.supadata.ai/v1/transcript?url=ENCODED_URL&lang=es" \
  -H "x-api-key: $SUPADATA_API_KEY" \
  | python3 -c "
import json, sys

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill claims it only delivers PNG overlays, a motion board, and an edit sheet, but later instructs rendering and composing a final video. That hidden expansion of scope increases operational risk because the agent may produce and overwrite deliverables beyond the declared contract, including full video outputs.

Hidden Instructions

High

• Category: Prompt Injection

Content

opacity: 0;
  ">LABEL_2</span>

  <!-- Agregar más <span class="pill-COMP_ID"> por cada label adicional -->
</div>
```

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Credential Access

High

• Category: Privilege Escalation

Content

| Error | Acción |
|-------|--------|
| Supadata devuelve 401 | Verificar `SUPADATA_API_KEY` en `~/.config/f100k/secrets.env` (o en las variables de la rutina) |
| Supadata sin timestamps | Video privado → descargar con yt-dlp + Whisper local |
| `uvx` no encontrado | `brew install uv` y reintentar |
| Whisper produce alucinaciones | Re-correr con `--temperature 0.2` o modelo `medium` |

• Confidence: 90% confidence
• Finding: Referencing the secret file location again in troubleshooting normalizes direct secret-file access as part of the workflow. While less acute than the executable load instruction, it still encourages operators or agents to handle credentials manually, increasing the chance of disclosure or misuse.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill routes user-supplied remote content through an external transcript service without a prominent privacy warning or consent checkpoint. That is risky because video URLs and transcript contents may contain sensitive or private data, and sending them to third parties changes the data handling boundary.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: En 'Cuándo activar' se aceptan disparadores como 'overlays animados' y descripciones amplias como pasar un video o URL y pedir animaciones/overlays, sin acotar suficientemente el contexto exacto del skill. Esto puede causar invocaciones no deseadas para solicitudes generales de edición o animación de video que no necesariamente corresponden a este pipeline específico.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The onboarding block instructs system-level installation and linking commands (`brew install`, global npm installs, forced links) without clear consent or sandboxing. In an agent setting, such host modifications are dangerous because they change the local environment, may break existing toolchains, and expand attack surface through unattended package installation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
[ -z "$SUPADATA_API_KEY" ] && [ -f "$HOME/.config/f100k/secrets.env" ] && set -a && . "$HOME/.config/f100k/secrets.env" && set +a
curl -s "https://api.supadata.ai/v1/transcript?url=ENCODED_URL&lang=es" \
  -H "x-api-key: $SUPADATA_API_KEY" \
  | python3 -c "
import json, sys

• Confidence: 94% confidence
• Finding: The `curl` call sends a user-provided media URL to `api.supadata.ai`, which is an external transmission of potentially sensitive content metadata and derived transcript material. In the context of an agent skill, this is dangerous because it moves user data outside the local environment without a strong, visible consent and privacy boundary.

Natural-Language Policy Violations

Medium

• Confidence: 99% confidence
• Finding: La llamada a la API fija 'lang=es', lo que impone un idioma específico de transcripción sin opción de elección u opt-in del usuario. Esto constituye una restricción de idioma no documentada como regional ni justificada en la política del archivo.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 65% confidence
• Finding: uvx/uv tool run commands without ==version create a rug-pull risk.

Natural-Language Policy Violations

Medium

• Confidence: 99% confidence
• Finding: El comando de mlx-whisper incluye '--language es', obligando a transcribir en español independientemente del contenido o preferencia del usuario. No se ofrece selección de idioma ni se documenta una justificación regional explícita para esta limitación.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: La alternativa con HyperFrames transcribe usando '--language es', repitiendo la misma política rígida de idioma en el camino de fallback. Al no ofrecer elección ni explicar una restricción regional formal, sigue siendo una violación de política de idioma.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: Earlier Step 5 explicitly says the stage should use `background:transparent` with real alpha and not the old `#FF00FF` chroma-key path. The base HTML template then says `body { background: #FF00FF; }` and even warns 'NUNCA transparent', which is the opposite of the prior guidance.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The top-of-file OpenClaw block says Steps 6 and 7 do not run here and that there is no `video_final_motion.mp4`, but the comparison table later lists this skill's output as 'Video MP4 final con overlays'. These two pieces of documentation actively disagree about what the skill produces in this environment.

Natural-Language Policy Violations

Low

• Confidence: 77% confidence
• Finding: This file is a code-like asset, so only SQP-2 and SQP-3 apply. The comment 'woff2 latin locales (incluye español)' explicitly references a language/locale choice, but the file does not indicate user opt-in or present it as an optional locale selection; that can conflict with the policy against forcing a specific language/locale without opt-in.

Static analysis

No suspicious patterns detected.