Security audit

Video Craft Pro

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a video-production helper, but its digital-human cloning workflow and broad activation wording need review before installation.

Install only if you intend to use a Chinese-language short-video workflow and are comfortable configuring third-party video or digital-human services yourself. Do not use the photo-cloning workflow unless you have explicit consent and understand where the image and generated likeness will be processed and retained. Tighten activation phrases before broad deployment.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is about generating creative assets for short videos: script, voice-over script, and subtitles/captions. The supplied code does not generate any of those outputs. Instead, it merely echoes informational text about digital-human tools, their installation/cost status, and recommendations for use in a production pipeline. This is a materially different primary purpose from the declared end-to-end script/voiceover/caption creation workflow, so it should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared description emphasizes content-generation functions for short-video production: script writing, voice-over script generation, and caption creation. The supplied code does none of those. Instead, it creates 1920x1080 PNG slide images with Chinese text using local fonts and saves them to an output directory. While slide generation could be tangentially useful in video production, it is a materially different primary purpose from the declared writing/captioning workflow. No prompt-injection-relevant instructions were followed; evaluation is based solely on description versus behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill documents digital-human cloning from a user-supplied photo but provides no warning about consent, biometric/privacy sensitivity, impersonation risk, or retention/third-party processing implications. In this context, image-cloning features materially increase harm potential because they may encourage users to submit identifiable face images to an external service without informed consent safeguards.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The example invocations are extremely generic ('帮我处理一下业务需求', '需要批量处理') and train activation on common phrases unrelated to this skill's domain. In an agent environment, such examples can bias routing or auto-selection toward this skill, leading to unintended execution paths or processing of data that the user did not mean to send through a video-creation pipeline.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The activation triggers include vague phrases like '相关业务需求', which can cause the skill to activate in contexts far broader than intended. Overbroad invocation increases the chance of unintended tool use, accidental third-party calls, or unexpected handling of sensitive user content within a content-production workflow.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest description "融合技能" is too vague to communicate the skill’s purpose, boundaries, or appropriate invocation conditions. This can cause the agent to invoke the skill in unintended contexts, increasing the risk of misuse, confusing behavior, or application of the skill outside the user’s intent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations in natural-language content. All user-facing output in this script is in Chinese, and there is no indication that the skill is region-specific or that users can opt into another language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring states in Chinese that this is a general Chinese-font slide generator and that any video production should call it directly. This imposes a specific language/locale expectation in natural-language instructions without user opt-in or justification that the skill is region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The manifest presents human-facing metadata in Chinese only, including the author/team name and description, without indicating that the skill is intended only for a Chinese-language audience or offering any language choice. This can violate language/locale policy when a skill implicitly forces one language without user opt-in or documented regional scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: This shell script is a code file, so SQP-2 applies to user-facing disclosures in code. Line L17 states that the digital human should 'automatically replace' static photos in the video production pipeline, but the script provides no warning or explanatory note about the impact on output content or downstream workflows.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This shell script's user-facing comments and echoed output are entirely in Chinese, and there is no indication that the user can choose a preferred language or locale. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is reportable unless the locale restriction is clearly documented and justified.
Content: No source excerpt is available for this finding.