SenseAudio Video Gen

• Outcome: Review
• Latest audit: May 28, 2026 · 10:32 AM UTC
• Version: 1.0.0

Overview

This is a coherent video-generation skill, but it needs review because it can combine website capture, local credentials or browser sessions, and external AI/API calls with limited privacy containment.

Install only if you are comfortable with a media-production tool that can call external AI/media providers and store generated project artifacts locally. Avoid using real browser profiles or exported cookies unless the site is approved for capture, prefer a dedicated temporary profile, use `--llm none` or saved/offline inputs for sensitive material, and do not enable vision audit or site-asset downloads for private or authenticated pages unless you have confirmed the data can leave the machine.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Tainted flow: 'url' from pathlib.Path.read_text (line 2399, file read) → urllib.request.urlopen (network output)

High

• Category: Data Flow

Content

def download_url(url: str, output: str) -> str:
    out = Path(output)
    out.parent.mkdir(parents=True, exist_ok=True)
    with urllib.request.urlopen(url, timeout=300) as resp:
        out.write_bytes(resp.read())
    return str(out)

• Confidence: 97% confidence
• Finding: download_url fetches arbitrary URLs and writes the response to disk without domain allowlisting or scheme restrictions. Because many upstream URLs come from remote models, inspected sites, or API responses, this creates an SSRF/exfiltration-style primitive and can also persist malicious or sensitive content locally.

Tainted flow: 'req' from pathlib.Path.read_bytes (line 992, file read) → urllib.request.urlopen (network output)

High

• Category: Data Flow

Content

headers=chat_headers(api_key, provider),
    )
    try:
        with urllib.request.urlopen(req, timeout=120) as resp:
            raw = resp.read().decode("utf-8")
    except urllib.error.HTTPError as exc:
        body = exc.read().decode("utf-8", errors="replace")

• Confidence: 91% confidence
• Finding: The OpenAI-compatible chat completion function transmits arbitrary brief/site content to external LLM providers. In this skill, those inputs may include scraped website text, README contents, or internal materials, so the risk is unbounded outbound disclosure rather than mere model usage.

Tainted flow: 'req' from pathlib.Path.read_bytes (line 992, file read) → urllib.request.urlopen (network output)

High

• Category: Data Flow

Content

},
    )
    try:
        with urllib.request.urlopen(req, timeout=180) as resp:
            raw = resp.read().decode("utf-8")
    except urllib.error.HTTPError as exc:
        body = exc.read().decode("utf-8", errors="replace")

• Confidence: 96% confidence
• Finding: The vision completion path uploads image data URLs built from local files to a remote provider. If those images come from authenticated site captures or internal renders, the skill can disclose sensitive visual information externally without adequate safeguards.

Tainted flow: 'req' from pathlib.Path.read_bytes (line 992, file read) → urllib.request.urlopen (network output)

High

• Category: Data Flow

Content

for attempt in range(3):
        req = urllib.request.Request(url, headers=headers_map)
        try:
            with urllib.request.urlopen(req, timeout=timeout) as resp:
                raw = resp.read()
                charset = resp.headers.get_content_charset() or "utf-8"
            return raw.decode(charset, errors="replace")

• Confidence: 95% confidence
• Finding: fetch_url_text retrieves arbitrary user-provided URLs and follows redirects, then falls back to curl if needed. Without allowlisting or private-network protections, this can be abused for SSRF against internal endpoints or cloud metadata services reachable from the agent host.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The skill explicitly supports loading an external Chrome profile and imported cookies to capture websites, including authenticated or region-gated pages. That can expose session cookies, private account content, and internal pages to subsequent processing, screenshots, asset downloads, and third-party AI uploads, which is a real privacy and data-exfiltration risk in an agent context.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The code can automatically download and archive up to 80 third-party assets discovered on inspected sites. In practice this may collect copyrighted, private, or authenticated resources into the local workspace without clear scoping or consent, expanding the blast radius of any capture beyond what the user expected.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The vision-audit path uploads local render frames and screenshots to OpenRouter-compatible remote models. Those frames may contain proprietary website content, internal project material, or authenticated captures, so this is a direct external transmission channel for sensitive visual data.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The README states the skill defaults generated video copy to Chinese unless the user explicitly requests another language. That can override user expectations and silently transform content into a different language, which is a security-relevant integrity and consent issue in an agent setting because outputs may become misleading, unusable, or socially engineered for an unintended audience. The surrounding context makes this more plausible because the skill is designed to autonomously generate customer-facing media from briefs and websites.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation explicitly says the CLI will read `SENSEAUDIO_API_KEY` from local workspace credential files if the environment variable is absent, but it provides no warning about secure storage, least-privilege access, or the risk of unintended credential discovery from other local contexts. In an agent skill that may process repositories and workspaces, this increases the chance of silent credential use and accidental cross-project secret exposure.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The one-pass website pipeline describes ingesting site evidence, screenshots, audio, and optional vision review by external LLM/media providers, but it does not warn users that website content, media, and derived artifacts may be transmitted off-box. Because this skill is designed to inspect websites, repos, and media, the omission can lead users to unknowingly send proprietary or sensitive content to third parties.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: Defaulting generated copy to `zh-CN` without explicit user choice can create misleading or unusable output, especially in workflows that may publish captions, narration, or marketing content automatically. While not a classic security flaw, it can cause integrity and trust issues by producing content in an unintended language.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The workflow explicitly tells operators to provide a public `--audio-url` so narration or music can influence generation, but it does not warn that making audio publicly accessible may expose sensitive voice content, proprietary media, or private URLs to third parties. In a media-production skill, users may upload drafts, client recordings, or internal assets, so normalizing public hosting without privacy guidance creates a real data-exposure risk.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: Defaulting generated copy to `zh-CN` without explicit user opt-in can cause unintended language output, misleading narration, and incorrect captions, especially for users expecting another language. While this is primarily a product safety and usability issue rather than a classic security flaw, in this context it can still cause accidental publication of incorrect or inaccessible content.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_cli.py:19

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/api.md:63

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/senseaudio_video_gen.py:6112