motion-reels-f100k

• Outcome: Review
• Latest audit: Sep 17, 2026 · 4:20 PM UTC
• Version: 1.0.0

Overview

The skill mostly matches a reel-overlay workflow, but it asks for persistent system installs, local secret-file access, third-party transcript calls, and includes conflicting instructions about whether it should edit/render final videos.

Install only if you are comfortable with a skill that can run shell commands, install or relink system tools, use unpinned npm/uvx packages, read an API key from a local secret file, and send remote video URLs to Supadata. Prefer running it in a contained environment, provide secrets only through environment variables, and require explicit approval before installs, external transcript calls, cutting, rendering, or composing video.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (25)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

La descripción declara un sistema integral de diseño de motion graphics para reels, con análisis visual, clasificación semántica del guion, selección entre varios formatos de tarjeta y entregables de producción. El código proporcionado no realiza nada de eso: solo genera HTML/GSAP para mostrar una frase palabra por palabra con animación cinética. Aunque la descripción menciona 'frases → kinetic', este fragmento cubre únicamente esa pieza específica y no representa la funcionalidad principal declarada ni los entregables anunciados. Por tanto, hay una discrepancia material entre la descripción amplia y el comportamiento real del código mostrado.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest says the agent does not edit or compose video, yet the documented workflow includes video cutting and mutation of the source processing path. This discrepancy can cause an agent or operator to perform destructive or out-of-scope media transformations they did not consent to, undermining policy boundaries and user expectations.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The skill instructs loading credentials from ~/.config/f100k/secrets.env, which is a direct secret-access pattern. In an agent environment, encouraging reads from local secret stores is dangerous because a compromised or overly broad workflow could expose API keys to logs, downstream commands, or untrusted outputs.

Content

Scanner excerpt · SKILL.md (reported line 279)May include surrounding context.

Fuente remota (YouTube / Instagram / TikTok) → Supadata API

bash

[ -z "$SUPADATA_API_KEY" ] && [ -f "$HOME/.config/f100k/secrets.env" ] && set -a && . "$HOME/.config/f100k/secrets.env" && set +a
curl -s "https://api.supadata.ai/v1/transcript?url=ENCODED_URL&lang=es" \
  -H "x-api-key: $SUPADATA_API_KEY" \
  | python3 -c "

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 280)May include surrounding context.

bash

[ -z "$SUPADATA_API_KEY" ] && [ -f "$HOME/.config/f100k/secrets.env" ] && set -a && . "$HOME/.config/f100k/secrets.env" && set +a
curl -s "https://api.supadata.ai/v1/transcript?url=ENCODED_URL&lang=es" \
  -H "x-api-key: $SUPADATA_API_KEY" \
  | python3 -c "
import json, sys

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill claims it only delivers PNG overlays, a motion board, and an edit sheet, but later instructs rendering and composing a final video. That hidden expansion of scope increases operational risk because the agent may produce and overwrite deliverables beyond the declared contract, including full video outputs.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 713)May include surrounding context.

opacity: 0; ">LABEL_2

```

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Referencing the secret file location again in troubleshooting normalizes direct secret-file access as part of the workflow. While less acute than the executable load instruction, it still encourages operators or agents to handle credentials manually, increasing the chance of disclosure or misuse.

Content

Scanner excerpt · SKILL.md (reported line 1282)May include surrounding context.

md

| Error | Acción |
|-------|--------|
| Supadata devuelve 401 | Verificar `SUPADATA_API_KEY` en `~/.config/f100k/secrets.env` (o en las variables de la rutina) |
| Supadata sin timestamps | Video privado → descargar con yt-dlp + Whisper local |
| `uvx` no encontrado | `brew install uv` y reintentar |
| Whisper produce alucinaciones | Re-correr con `--temperature 0.2` o modelo `medium` |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill routes user-supplied remote content through an external transcript service without a prominent privacy warning or consent checkpoint. That is risky because video URLs and transcript contents may contain sensitive or private data, and sending them to third parties changes the data handling boundary.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

En 'Cuándo activar' se aceptan disparadores como 'overlays animados' y descripciones amplias como pasar un video o URL y pedir animaciones/overlays, sin acotar suficientemente el contexto exacto del skill. Esto puede causar invocaciones no deseadas para solicitudes generales de edición o animación de video que no necesariamente corresponden a este pipeline específico.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The onboarding block instructs system-level installation and linking commands (brew install, global npm installs, forced links) without clear consent or sandboxing. In an agent setting, such host modifications are dangerous because they change the local environment, may break existing toolchains, and expand attack surface through unattended package installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

The curl call sends a user-provided media URL to api.supadata.ai, which is an external transmission of potentially sensitive content metadata and derived transcript material. In the context of an agent skill, this is dangerous because it moves user data outside the local environment without a strong, visible consent and privacy boundary.

Content

Scanner excerpt · SKILL.md (reported line 280)May include surrounding context.

bash

[ -z "$SUPADATA_API_KEY" ] && [ -f "$HOME/.config/f100k/secrets.env" ] && set -a && . "$HOME/.config/f100k/secrets.env" && set +a
curl -s "https://api.supadata.ai/v1/transcript?url=ENCODED_URL&lang=es" \
  -H "x-api-key: $SUPADATA_API_KEY" \
  | python3 -c "
import json, sys

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

La llamada a la API fija 'lang=es', lo que impone un idioma específico de transcripción sin opción de elección u opt-in del usuario. Esto constituye una restricción de idioma no documentada como regional ni justificada en la política del archivo.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 65% confidence

Finding

uvx/uv tool run commands without ==version create a rug-pull risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

El comando de mlx-whisper incluye '--language es', obligando a transcribir en español independientemente del contenido o preferencia del usuario. No se ofrece selección de idioma ni se documenta una justificación regional explícita para esta limitación.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

La alternativa con HyperFrames transcribe usando '--language es', repitiendo la misma política rígida de idioma en el camino de fallback. Al no ofrecer elección ni explicar una restricción regional formal, sigue siendo una violación de política de idioma.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Earlier Step 5 explicitly says the stage should use background:transparent with real alpha and not the old #FF00FF chroma-key path. The base HTML template then says body { background: #FF00FF; } and even warns 'NUNCA transparent', which is the opposite of the prior guidance.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The top-of-file OpenClaw block says Steps 6 and 7 do not run here and that there is no video_final_motion.mp4, but the comparison table later lists this skill's output as 'Video MP4 final con overlays'. These two pieces of documentation actively disagree about what the skill produces in this environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

This file is a code-like asset, so only SQP-2 and SQP-3 apply. The comment 'woff2 latin locales (incluye español)' explicitly references a language/locale choice, but the file does not indicate user opt-in or present it as an optional locale selection; that can conflict with the policy against forcing a specific language/locale without opt-in.

Content

No source excerpt is available for this finding.