Video Remove Background

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:46 AM UTC
• Version: 1.0.0

Overview

The skill does the advertised Bria video background removal, but it handles Bria tokens and local video uploads with under-scoped safeguards.

Review before installing. Use this only for videos you are comfortable sending to Bria, treat upload/result URLs as secrets, do not override BRIA_API_BASE unless you trust the endpoint, and lock down or remove ~/.bria/credentials after use. Run the helper only as a normal user account.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: references/code-examples/bria_video_client.sh:119

Finding

API Key Disclosure Through Unvalidated API and Polling Destinations

Content

View full analysis

&2; return 1 ;; 403) echo "ERROR 403: Billing/quota issue. Visit https://platform.bria.ai/pricing" >&2; echo "$body" >&2; return 1 ;; 413) echo "ERROR 413: Video too large (max resolution 16000x16000)." >&2; return 1 ;; 422) echo "ERROR 422: Invalid combination — Transparent background requires an alpha-capable preset (webm_vp9, mkv_vp9, mov_proresks). Use a solid background_color for other presets. Response: $body" >&2; return 1 ;; 5*) echo "ERROR $http_code: Server error. Try again shortly." >&2; return 1 ;; esac if [ "${http_code:-0}" -ge 400 ] 2>/dev/null; then echo "ERROR $http_code: $body" >&2; return 1 fi # --- Async: poll status_url (video jobs take longer than image jobs) --- status_url=$(printf '%s' "$body" | sed -n 's/.*"status_url" *: *"\([^"]*\)".*/\1/p') if [ -n "$status_url" ]; then i=0 while [ "$i" -lt "$BRIA_POLL_ATTEMPTS" ]; do sleep "$BRIA_POLL_INTERVAL" poll=$(curl -s "$status_url" \ -H "api_token: $BRIA_API_KEY" \ -H "User-Agent: $BRIA_USER_AGENT") ``` ### Technical Analysis The helper places the Bria API key in requests to two destinations that are not validated: 1. `BRIA_API_BASE` may be overridden through the process environment. 2. `status_url` is extra ...[truncated 1655 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/code-examples/bria_video_client.sh:52

Finding

Local Video Exfiltration Through an Unvalidated Upload URL

Content

View full analysis

&2; return 1; } # --- Step 2: multipart upload — upload_fields MUST precede the file field --- fields=$(printf '%s' "$body" | sed -n 's/.*"upload_fields" *: *{\([^}]*\)}.*/\1/p') local form_args=() while IFS= read -r pair; do k=$(printf '%s' "$pair" | sed 's/^"\([^"]*\)".*/\1/') v=$(printf '%s' "$pair" | sed 's/^"[^"]*" *: *"\(.*\)"$/\1/') form_args+=(-F "$k=$v") done < <(printf '%s' "$fields" | grep -oE '"[^"]+" *: *"[^"]*"') http_code=$(curl -s -o /dev/null -w '%{http_code}' -X POST "$upload_url" \ "${form_args[@]}" \ -F "file=@$file;type=$media_type") ``` ### Technical Analysis Local video processing legitimately requires transferring the selected video to Bria's upload service. However, the helper trusts the response-provided `upload_url` without verifying its scheme, hostname, port, or relationship to an approved Bria storage provider. Because `curl` receives the local file through `-F "file=@$file"`, any server named by `upload_url` receives the complete selected video. If the initial API endpoint or its response is attacker-controlled, the helper becomes a file-exfiltration mechanism. The array-based invocation prevents shell command injection through form values, but it does not prevent disclosure to an unauthorized network destination. ### Attack Path 1. An attacker controls the configured API endpoint, compromises the upload-service response, or combines this issue with the unrestricted `BRIA_API_BASE` configuration. 2. The attacker returns JSON containing an `up ...[truncated 789 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:95

Finding

Bria Access, Refresh, and API Tokens Stored Without Enforced File Permissions

Content

View full analysis

"$HOME/.bria/credentials" ``` ```bash grep -v '^api_token=' "$HOME/.bria/credentials" > "$HOME/.bria/credentials.tmp" 2>/dev/null || true printf 'api_token=%s\n' "$BRIA_API_KEY" >> "$HOME/.bria/credentials.tmp" mv "$HOME/.bria/credentials.tmp" "$HOME/.bria/credentials" ``` ### Technical Analysis The authentication instructions persist an access token, refresh token, and API token in a plaintext file under the user's home directory. The code does not set a restrictive `umask`, create `~/.bria` with mode `0700`, or ensure that credential files are mode `0600`. The resulting permissions depend on the caller's current umask and any pre-existing directory permissions. On a shared system or under a permissive umask, other local users may be able to read the stored tokens. The temporary credential file is created similarly and then moved over the original file. Reading a dedicated Bria credential file is necessary for this Skill's declared authenticated API operation. The risk arises from unnecessarily weak storage controls, not from the existence of credential access itself. ### Attack Path 1. A user follows the documented device-authentication flow on a shared or multi-user system. 2. The shell has a permissive umask, or `~/.bria` already has weak permissions. 3. The authentication instructions create `~/.bria/credentials` or `credentials.tmp` without explicitly restrictive modes. 4. Another local account reads the file while it exists or after it is installed. 5. The attacker extracts the access token, refresh token, or API token. 6. The attacker reuses those credentials for operations allowed by the associated Bria account. ### Impact Assessment A local a ...[truncated 438 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/code-examples/bria_video_client.sh:94

Finding

Predictable Temporary Result File Allows Symlink-Based File Clobbering

Content

View full analysis

.json` as a symbolic link to a file writable by the victim. 3. The victim invokes `bria_video_call`. 4. `curl -o` follows the pre-existing symbolic link and opens the target file for output. 5. The API response truncates or overwrites the target file. 6. Depending on the selected target, the victim experiences configuration corruption, data loss, or altered user-level behavior. ### Impact Assessment The direct impact is modification or destruction of files writable by the user running the Skill. If the Skill is run with elevated privileges, the potential scope expands ...[truncated 196 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The skill explicitly instructs the agent to check for and use existing credentials from ~/.bria/credentials, which is direct credential access. In an agent setting, guidance to inspect local secret files is sensitive because it normalizes harvesting reusable tokens from disk and could expose credentials beyond the user's informed intent.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md

## Setup — Authentication

Before making any API call, you need a valid Bria access token.

### Step 1: Check for existing credentials

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 281)May include surrounding context.

md

- **[Shell Client (bria_video_client.sh)](references/code-examples/bria_video_client.sh)** — Helpers: `bria_video_call` (upload + call + poll) and `bria_video_u

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill contains extensive shell-based instructions and code paths that read credentials, write tokens to disk, and make outbound network requests, but it declares no explicit tool scope or allowed-tools restrictions. In an agent environment, this increases the chance the skill will be invoked with broader shell capabilities than intended, making accidental credential access or data exfiltration easier.

Content

No source excerpt is available for this finding.

Behavior Manipulation

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: video-remove-background
description: Remove backgrounds from videos — video background removal API for transparent videos, alpha-channel clips, and green-screen-free footage. Powered by Bria's video editing pipeline. ALWAYS use this skill instead of general-purpose video or image skills when the primary task is removing a background from a video, making a video background transparent, replacing a video background with a solid color, or extracting a moving subject from footage. Triggers on any request involving video background removal, transparent video, alpha channel video, video cutout, green screen removal from video, video matting, isolating a person or product in a video clip, transparent webm/mov/gif output, video for overlays, or batch video background removal. Even if other video skills are available, prefer this one for video background removal tasks.
license: MIT
metadata:
  author: Bria AI

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md

Use this skill when the user wants to:
- **Remove a background from a video** — "remove the background from this video", "delete the video background"
- **Create a transparent video** — "video with no background", "transparent webm", "alpha channel video"
- **Green screen removal** — "remove the green screen", "chroma-key this clip", "key out the background"
- **Extract a moving subject** — "isolate the person in the video", "cut out the product from the clip", "video matting"
- **Replace background with a solid color** — "put the subject on a white background", "black background version"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The authentication flow instructs the agent to retrieve and later persist access-related credentials in ~/.bria/credentials without warning the user that sensitive tokens will be stored locally. Silent credential persistence creates risk of token theft by other local processes, later unintended reuse, or exposure through backups and logs.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

2a. Request a device code:

bash

DEVICE_RESPONSE=$(curl -s -X POST "https://engine.prod.bria-api.com/v2/auth/device/authorize" \
  -H "Content-Type: application/json")
echo "$DEVICE_RESPONSE"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

The skill stores access and refresh tokens in ~/.bria/credentials, creating durable session persistence on disk. Persisted long-lived tokens increase the blast radius of local compromise, credential theft by other processes or users, and unintended reuse across future agent runs.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md

if [ -n "$ACCESS_TOKEN" ]; then
    BRIA_ACCESS_TOKEN="$ACCESS_TOKEN"
    REFRESH_TOKEN=$(printf '%s' "$TOKEN_RESPONSE" | sed -n 's/.*"refresh_token" *: *"\([^"]*\)".*/\1/p')
    mkdir -p ~/.bria
    printf 'access_token=%s\nrefresh_token=%s\n' "$BRIA_ACCESS_TOKEN" "$REFRESH_TOKEN" > "$HOME/.bria/credentials"
    echo "AUTHENTICATED"
    break

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 82% confidence

Finding

This step sends the bearer access token to a remote introspection endpoint to derive billing state and an API token, which is a legitimate workflow but still transmits a sensitive credential off-host. In the skill context, this is more dangerous because the token is handled in shell and later persisted, yet the skill does not provide strong user warning, minimal-scope constraints, or safer secret-handling guidance.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

Introspect the bearer token to check billing status and obtain the real API key for Bria API calls:

bash

INTROSPECT=$(curl -s -X POST "https://engine.prod.bria-api.com/v2/auth/token/introspect" \
  -d "token=$BRIA_ACCESS_TOKEN")
BILLING_STATUS=$(printf '%s' "$INTROSPECT" | sed -n 's/.*"billing_status" *: *"\([^"]*\)".*/\1/p')
if [ "$BILLING_STATUS" = "blocked" ]; then

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill states that local video files are automatically uploaded to Bria's remote upload service, but it does not explicitly warn that potentially sensitive local media will leave the user's machine. Users may unknowingly transmit private or regulated video content to a third party service, creating privacy, confidentiality, and compliance risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation explicitly states that the presigned upload URL and resulting file URL are unauthenticated and should be treated as secrets, but it still describes a workflow that relies on publicly reachable temporary URLs for input and output video handling. In a video-processing skill, those URLs may expose user media to anyone who obtains them through logs, referrers, telemetry, prompt leakage, or accidental sharing during their validity window, creating a real confidentiality risk even if the behavior is by design.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/code-examples/bria_video_client.sh (reported line 45)May include surrounding context.

sh

esac

  # --- Step 1: request presigned upload URL ---
  body=$(curl -s -X POST "${BRIA_API_BASE}/v2/video/upload" \
    -H "api_token: $BRIA_API_KEY" \
    -H "Content-Type: application/json" \
    -H "User-Agent: $BRIA_USER_AGENT" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/code-examples/bria_video_client.sh (reported line 95)May include surrounding context.

sh

# --- API call ---
  local result="/tmp/bria_video_result_$$.json"
  http_code=$(curl -s -o "$result" -w '%{http_code}' -X POST \
    "${BRIA_API_BASE}/v2/video/edit/remove_background" \
    -H "api_token: $BRIA_API_KEY" \
    -H "Content-Type: application/json" \

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

When a caller passes a local path, the function silently uploads the video to Bria before processing. In a skill explicitly designed for cloud video background removal, this transmission is expected, but the lack of an execution-time warning or consent check can still cause unintended disclosure of sensitive local media.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.