Security audit
Security checks for vulnerabilities and agentic risk
The skill does what it claims, but it can download and reuse executable runtimes from remote, manifest-controlled sources and can redirect API credentials and videos through environment-configured endpoints.
Install only if you trust Pixmind's API, CDN, and runtime manifests, and avoid using custom PIXMIND_API_BASE, PIXMIND_NODE_MANIFEST, or PIXMIND_FFMPEG_MANIFEST values unless you control and trust those endpoints. Prefer preinstalled Node.js and FFmpeg where possible, and do not submit private videos unless you are comfortable uploading them to the configured service.
scripts/video-to-prompt.js:9Configurable API endpoint can exfiltrate the API key and local video content
scripts/video-to-prompt.js:237Remote manifests control downloaded executables and their integrity metadata
The declared skill purpose is storyboard extraction, but the instructions also authorize downloading and executing portable Node.js and FFmpeg binaries from remote sources. This is dangerous because it hides a software bootstrapper inside a media-analysis skill, expanding the attack surface to remote code execution, supply-chain compromise, and unexpected host modification behavior that a user may not reasonably anticipate from the description.
The script allows the download manifest source to be overridden via the PIXMIND_NODE_MANIFEST environment variable, and then uses manifest-provided URLs and hashes to fetch and execute node.exe. Because the trust root is fully redirectable by environment control, an attacker who can influence the environment can supply a malicious manifest that points to an attacker-controlled runtime and matching checksum, resulting in arbitrary code execution.
The manifest URL is overrideable via the PIXMIND_NODE_MANIFEST environment variable, allowing an attacker who can influence the environment to redirect the launcher to attacker-controlled metadata and potentially an attacker-chosen executable. Even with SHA validation, the attacker-controlled manifest also provides the expected hash, so this check does not prevent arbitrary binary execution.
The skill clearly instructs use of environment secrets, network access, and shell execution, but it does not declare any explicit tool scope or permissions boundary. That makes the effective capability set broader and less auditable, increasing the chance that a host grants powerful operations implicitly, including remote downloads and local command execution.
The instruction says to default to zh-cn unless the user supplies another value. This imposes a specific language/locale choice by default rather than offering a neutral default or explicit user opt-in, which matches the language/locale policy violation category.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Errors and security
- HTTP 400: check that exactly one valid video was supplied and that it is no longer than 10 minutes.
- HTTP 401: configure `PIXMIND_API_KEY`; never ask the user to paste the key into chat.
- HTTP 402: report insufficient credits and stop.
- The API key is configured in the environment or the client's Pixmind provider settings.
- If both portable runtime sources fail, report the launcher's official Node.js installation
The default prompt auto-invokes the skill with a broad phrase ('Use $pixmind-video-to-prompt to analyze this video') and does not define clear constraints on when the tool should be used or what inputs are acceptable. In an agent setting, this can cause over-eager activation on ambiguous user requests, increasing the chance of unintended remote URL processing, data handling, or prompt-routing abuse.
This bootstrapper installs and runs an external Node.js binary even though the skill is presented as a video-to-prompt analysis tool. While downloading a runtime can be operationally legitimate, it expands the attack surface by introducing network retrieval and execution of a binary at runtime, which is riskier than the apparent skill description suggests.
The script downloads and stores an executable to a local cache and may execute it without any user-facing notice or consent step. Even with hash checking, silent runtime installation reduces user awareness and increases the chance that unexpected code execution occurs in environments with stricter software provenance or change-control requirements.
The launcher fetches and installs a Node.js runtime from remote locations before running the skill, which expands behavior beyond simple local video analysis into remote code acquisition and execution. Although integrity checks are present, this still creates a supply-chain and trust-boundary risk because the skill can introduce executable code not bundled with the package.
The script downloads and executes a runtime binary without any explicit user-facing confirmation, which reduces transparency around a security-sensitive action. In the context of a video-to-prompt skill, silent retrieval and execution of new code is unexpected and increases the risk of unnoticed supply-chain compromise or policy bypass.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
download="$temporary/node.download"
if [ -n "$url" ] && curl -fL --connect-timeout 15 --max-time 900 "$url" -o "$download"; then
chmod 755 "$download"
if valid_node "$download" "$size" "$sha256"; then
mv "$download" "$node"
"$node" "$script_dir/video-to-prompt.js" "$@"
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
download="$temporary/node.download"
if [ -n "$url" ] && curl -fL --connect-timeout 15 --max-time 900 "$url" -o "$download"; then
chmod 755 "$download"
if valid_node "$download" "$size" "$sha256"; then
mv "$download" "$node"
"$node" "$script_dir/video-to-prompt.js" "$@"
The help text states the default output language is zh-cn, and the code later enforces that default when no language is provided. This is a natural-language locale policy issue because the skill selects a specific language by default rather than offering a neutral default or explicit opt-in.
The script will automatically fetch a manifest from a remote server, download an FFmpeg executable from a CDN, validate it against that remotely supplied manifest, and then execute the binary locally. This creates a supply-chain trust problem: if the manifest/CDN or API base is compromised, or if environment variables are manipulated, the skill can be turned into a remote code execution path on the user's machine. In a video-processing skill, invoking FFmpeg is justified, but silently installing and executing a network-fetched executable materially increases risk beyond normal local file processing.
The code assigns args.language || "zh-cn", which forces Chinese output whenever the user does not specify a language. This violates the language/locale policy criterion because it imposes a locale choice without explicit user opt-in.