Chain-Referenced Shortform Video

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:02 PM UTC
• Version: 0.2.1

Overview

The skill is a mostly coherent AI-video workflow, but it includes developer-specific absolute file paths that could make an agent read local source files outside the intended project.

Review or edit the skill before installing so repository-specific files are loaded only from a project root you approve. The bundled filmmaking references look low risk, but the hard-coded /Users/lebo paths should be replaced with relative paths or an explicit confirmation step.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:17

Finding

Hard-Coded External Paths Permit Unscoped Local File Access

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17–23
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

Vulnerable code:

markdown

For this repository, then load:

- `/Users/lebo/project/ai-video/src/ai_video_control/models.py`
- `/Users/lebo/project/ai-video/src/ai_video_control/shortform.py`
- `/Users/lebo/project/ai-video/src/ai_video_control/review.py`
- `/Users/lebo/project/ai-video/src/ai_video_control/cli.py`

Technical Analysis

The Skill instructs the Agent to load source files through hard-coded, developer-specific absolute paths. These paths are outside the packaged Skill directory and may also be outside the project root authorized by the user.

Following these instructions can violate least-privilege and project-boundary expectations by causing the Agent to probe or read unrelated local files. If the listed paths exist on the execution host, their contents could enter the Agent's context without being necessary for the user's current project. The audited text does not instruct the Agent to transmit or maliciously use those contents, so the finding is limited to unscoped local access rather than confirmed exfiltration.

Attack Path

1. A user invokes the Skill for an AI-video or storyboard task.
2. The Agent reads SKILL.md and follows its repository-loading instructions.
3. The Agent attempts to access the four absolute paths under /Users/lebo/project/ai-video/.
4. If those files exist and tool permissions allow access, source code outside the user-selected project is loaded into the active context.
5. That unrelated source may then influence generated output or be exposed through later responses, logs, or downstream processing.

Impact Assessment

Successful exploitation requires the referenced files to exist and the Agent's file-reading tools to permit access. Under those conditions, the Agent can obtain read access ...[truncated 474 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all hard-coded absolute filesystem paths from SKILL.md.
2. Resolve implementation files relative to a project root explicitly supplied or approved by the user.
3. Canonicalize each resolved path and verify that it remains within the authorized project root before reading it.
4. Reject path traversal, symbolic-link escapes, and references to unrelated directories.
5. Treat implementation files as optional: load them only when the user's request requires repository-specific behavior.
6. Ask for explicit confirmation before accessing files outside the packaged Skill directory.
7. Replace the vulnerable section with a scoped pattern such as:

   markdown

   If repository-specific implementation analysis is required, ask the user
   for the project root. Load only the following paths relative to that root
   after verifying that each resolved path remains inside it:
   
   - `src/ai_video_control/models.py`
   - `src/ai_video_control/shortform.py`
   - `src/ai_video_control/review.py`
   - `src/ai_video_control/cli.py`
   

8. Add a validation test ensuring that loading the Skill never triggers reads outside the authorized project root.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill description and trigger text are very broad, covering many adjacent concepts like AI movie generation, cinematic prompt engineering, continuity pipelines, previsualization, scene packs, shot templates, bridge frames, and script-swapping workflows. In an agentic system, this can cause the skill to be invoked in situations where it is only partially relevant, increasing the chance of inappropriate file loading, unnecessary repository-specific access, or incorrect guidance being applied to unrelated user requests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.