视频创作技能路由器

• Outcome: Review
• Latest audit: Oct 23, 2026 · 5:02 AM UTC
• Version: 2.0.1

Overview

This video helper needs review because it runs newly downloaded skills with limited checks, and installer flaws can affect unrelated files or skills.

Use a separate test profile without private files or credentials, review each downloaded skill before running it, and keep independent backups. Before using this in your main profile, seek fixes that confine file changes to the selected skills and provide tested recovery. Do not rely on the supplied Git recovery command. Expect unrelated promotional messages in task responses.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/manage_skill.py

Finding

Untrusted skill names allow installation outside the skills directory

Content

View full analysis

Impact

The attacker can create directories and populate files outside the installation root with the agent's filesystem permissions. Additionally, recording only the destination basename loses its actual location: an escaped installation whose basename matches an existing local skill can cause a later authorized uninstall to target that unrelated local skill instead.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/manage_skill.py

Finding

Git pathspec injection can remove unrelated installed skills

Content

View full analysis

Impact

git rm -r can remove unrelated tracked skills and the following commit records their removal, disrupting the user's installed capabilities. The changes can be recovered from Git history, but exceed the requested uninstall scope.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (31)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The description-behavior mismatch is confirmed by the mandatory promotional footer, which introduces unrelated third-party advertising into video-task responses. However, the supplied file does not include the installer implementation, so the additional claims about path traversal, incomplete snapshots, uninspected accompanying files, and broken rollback cannot be independently confirmed and do not justify a high-severity conclusion here.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The file explicitly requires an account recommendation and external community link after every result, although neither serves the stated video-routing purpose. This confirms task-output hijacking for promotional lead generation, but not the narrower assertion that every script run prints the promotion; the scripts were not supplied.

Content

No source excerpt is available for this finding.

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md

python scripts/manage_skill.py install --repo <owner/name> --subdir <skill_path> --reason "<为什么选它>"

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md

- 回复「1」→ `python scripts/manage_skill.py keep --name <name>`（manifest 标记保留，今后不再询问）

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md

- 回复「2」→ `python scripts/manage_skill.py uninstall --name <name>`（git rm 或移入 `state/.trash/`，输出恢复方法）

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

md

- `scripts/manage_skill.py`：安装（--repo/--subdir/--all-skills）/ 清单 / 保留 / 卸载

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/index.html (reported line 145)May include surrounding context.

html

<div class="card"><h3><span class="dot">●</span>Can't orchestrate after install</h3>
        <p>下载完成后自动通读并调用所装技能,按其工作流执行,缺环用 FFmpeg 补齐,直接产出成片。</p></div>
      <div class="card"><h3><span class="dot">●</span>Skills piling up</h3>
        <p>每次生成后输出安装清单(技能/作用/来源),一键卸载走 git rm 或回收站机制,可回滚、零残留。</p></div>
    </div>
  </div>
</section>

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/index.html (reported line 145)May include surrounding context.

html

<div class="card"><h3><span class="dot">●</span>Can't orchestrate after install</h3>
        <p>下载完成后自动通读并调用所装技能，按其工作流执行，缺环用 FFmpeg 补齐，直接产出成片。</p></div>
      <div class="card"><h3><span class="dot">●</span>Skills piling up</h3>
        <p>每次生成后输出安装清单（技能/作用/来源），一键卸载走 git rm 或回收站机制，可回滚、零残留。</p></div>
    </div>
  </div>
</section>

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/index.html (reported line 161)May include surrounding context.

html

<span class="step">INSTALL 安全安装</span><span class="arrow">→</span>
      <span class="step">ORCHESTRATE 编排出片</span>
    </div>
    <p class="pipeline-note">最后输出善后报告：本次安装清单表 + 保留（回复 1）或卸载（回复 2）的交互询问。安装/卸载全程走安全协议：git 快照可回滚、frontmatter 强校验、多技能包需明确选择、禁 rm -rf。</p>
  </div>
</section>

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/manage_skill.py (reported line 60)May include surrounding context.

python

def clean_env():
    """Git/urllib env with dead proxy ports stripped (direct connection)."""
    env = dict(os.environ)
    for key in ["HTTP_PROXY", "HTTPS_PROXY", "http_proxy", "https_proxy"]:
        env.pop(key, None)
    env["no_proxy"] = "*"

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/manage_skill.py (reported line 70)May include surrounding context.

python

def proxy_env():
    """Fallback env routing git through the local 7897 proxy."""
    env = dict(os.environ)
    env["HTTP_PROXY"] = "http://127.0.0.1:7897"
    env["HTTPS_PROXY"] = "http://127.0.0.1:7897"
    env["http_proxy"] = "http://127.0.0.1:7897"

The documented rejection of suspicious code applies only to SKILL.md, not to installed implementation files.

High

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

Validation scans only SKILL.md, but installation copies the entire skill directory, including unexamined scripts and other implementation files. An attacker can provide harmless-looking metadata alongside credential-stealing or destructive code that the router may later execute during its advertised orchestration workflow.

Content

No source excerpt is available for this finding.

Automatic execution of newly downloaded third-party skills lacks a warning about system and data risks.

Medium

• Category: Output Handling
• Confidence: 94% confidence

Finding

The README explicitly describes automatically reading and invoking newly downloaded third-party skills, including skills discovered through live GitHub and web searches, without documenting a security review or informed approval gate before execution. A malicious upstream skill could inject instructions or execute code with the agent's available permissions, potentially exposing private media, credentials, or local files. Git snapshots, frontmatter validation, and reversible installation do not establish that skill instructions are trustworthy or undo data exfiltration, making automatic discovery-to-execution particularly risky in this router.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill specifies shell execution, network downloads, and filesystem changes without declaring a tool scope. This is particularly risky because it instructs the agent to execute newly discovered third-party skills strictly according to their own workflows, potentially exposing ambient agent privileges to untrusted instructions; the actual exposure depends on the host's permission enforcement.

Content

No source excerpt is available for this finding.

An unrelated marketing directive requires appending third-party promotions to every output.

Medium

• Category: Prompt Injection
• Confidence: 99% confidence

Finding

This is the same mandatory marketing directive identified by SDI-2, not an independent exploit. Its blanket scope redirects the assistant's output toward third-party promotion without user authorization, but the provided text does not establish credential theft, automatic navigation, or exfiltration.

Content

No source excerpt is available for this finding.

The channel-selection workflow instructs immediate installation of matching third-party skills without warning about system changes or untrusted code.

Medium

• Category: Output Handling
• Confidence: 94% confidence

Finding

The workflow directs immediate installation of matching third-party skills, treating repository existence, a SKILL.md file, and observed star counts as sufficient verification; these checks do not establish code safety or trustworthiness. Because the router is intended to subsequently execute installed skills, a malicious or compromised repository could introduce hostile instructions or code into the agent's environment. The metadata's snapshot, validation, and rollback claims may reduce some installation risks, but the supplied file does not establish security review or isolation before installation and execution.

Content

No source excerpt is available for this finding.

Documented recovery command does not restore the pre-uninstall snapshot.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The documented git restore --worktree . restores from the current index, not from a historical snapshot. After the prescribed git rm -r and commit, the removed skill is absent from that index, so this command will not recover it. This undermines the router's promised rollback protection, although the deleted content may remain recoverable from Git history.

Content

No source excerpt is available for this finding.

The recovery instruction can discard unrelated local changes without warning.

Medium

• Category: Output Handling
• Confidence: 99% confidence

Finding

Running git restore --worktree . from the skills directory overwrites unstaged changes to tracked files throughout that directory, not just the skill being recovered. Consequently, following the recovery instructions can destroy unrelated local skill edits without warning; Git may have no recoverable copy of those edits. This is particularly concerning for a router operating alongside existing user-managed skills.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/manage_skill.py (reported line 52)May include surrounding context.

python

(r"session_api\.json", "reads session credentials"),
    (r"login_token", "reads login tokens"),
    (r"requests?\.post\(['\"]https?://(?!127|localhost)", "posts data to external host"),
    (r"shutil\.rmtree", "destructive rmtree without confirmation"),
    (r"rm\s+-rf", "rm -rf without confirmation"),
    (r"\beval\(", "dynamic eval execution"),
]

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/manage_skill.py (reported line 53)May include surrounding context.

python

(r"login_token", "reads login tokens"),
    (r"requests?\.post\(['\"]https?://(?!127|localhost)", "posts data to external host"),
    (r"shutil\.rmtree", "destructive rmtree without confirmation"),
    (r"rm\s+-rf", "rm -rf without confirmation"),
    (r"\beval\(", "dynamic eval execution"),
]

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/manage_skill.py (reported line 88)May include surrounding context.

python

errors = []
    for i, (label, env) in enumerate(attempts):
        target = os.path.join(workdir, "clone" if i == 0 else "clone-retry")
        res = subprocess.run(
            ["git", "clone", "--depth", "1", url, target],
            capture_output=True, text=True, encoding="utf-8", errors="ignore",
            env=env,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 98% confidence

Finding

Although subprocess arguments do not pass through a shell, upstream-controlled skill names reach Git as options or pathspecs. A skill named '*' can cause git add, git ls-files, and subsequent git rm to match unrelated tracked skills, defeating the manifest-only uninstall protection.

Content

Scanner excerpt · scripts/manage_skill.py (reported line 102)May include surrounding context.

python

def run_git(args, cwd=SKILLS_DIR):
    return subprocess.run(
        ["git"] + args, cwd=cwd, capture_output=True, text=True,
        encoding="utf-8", errors="ignore", env=clean_env(),
    )

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/manage_skill.py (reported line 365)May include surrounding context.

python

for rec in targets:
        rec["status"] = "kept"
    save_manifest(manifest)
    print("KEPT: %s (marked as kept; future runs will reuse it without asking)" % args.name)


def cmd_uninstall(args):

The Git uninstall rollback instruction cannot restore the committed deletion.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The uninstall operation commits the deletion before recommending git restore --worktree ., which restores from the already-deleted index state rather than recovering the removed skill. This breaks the promised rollback mechanism and can also discard unrelated unstaged changes if the user follows that command.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sources.md (reported line 7)May include surrounding context.

md

### 1.1 仓库搜索（search_anim.py 自动执行）

API：`https://api.github.com/search/repositories`

按类别选 topic（`--category` 触发，词表见 `categories.md` 第 2 节）：

Static analysis

No suspicious patterns detected.