AI Short Film Finalization — Route C (Flow Free)

• Outcome: Review
• Latest audit: Jun 25, 2026 · 10:20 AM UTC
• Version: 1.0.2

Overview

This skill has a coherent video-review purpose, but it asks for risky browser-session control and has unsafe local file-output handling that users should review first.

Review this skill carefully before installing. Use a dedicated temporary browser profile, not your primary logged-in Chrome profile, and avoid workflows that kill your running browser. Only run the bundled script on trusted storyboard/project files, because scene titles influence generated filenames. The evidence supports Review rather than malicious: the risky behaviors are tied to the stated workflow, but they are overbroad and under-scoped.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill describes shell execution, file read/write, and automation against local tools, but it declares no permissions. That creates a trust-boundary problem: a caller or reviewer may believe the skill is documentation-only or low-privilege when it actually instructs actions that can modify files and run destructive commands. In this context, the gap increases the chance of unsafe execution without informed consent or proper sandboxing.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a mismatch because the declared description presents a broad short-film finalization pipeline with generation, narration, composition, review, and trailer features, while the actual code is narrowly scoped to post-processing an existing final movie into a director review bundle. The code reads a storyboard and final video, uses ffmpeg/ffprobe to extract shot-level media assets, and emits review.html plus manifest.json. Although 'director review console' is part of the declared description, the primary purpose and most claimed capabilities are absent from this code.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The instructions explicitly kill Chrome processes and launch Chrome against the user's live profile directory. That can destroy active browsing sessions, risk profile corruption, and operate on authenticated data without a clear warning or confirmation step. Because the profile contains cookies, tokens, history, and synced state, misuse could expose or alter sensitive user data.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill normalizes connecting over CDP to a browser session that already holds the user's Google authentication state, specifically to avoid OAuth, 2FA, and cookie handling. This is dangerous because any automation attached to that session can act as the user and access authenticated content, downloads, and account-linked resources without re-consent. In a security context, bypassing normal auth prompts by piggybacking on an existing session materially raises account and privacy risk.

Unvalidated Output Injection

High

• Category: Output Handling

Content

"-c:a", "aac", "-b:a", "128k", "-ar", "44100",
                str(clip_path)
            ]
            subprocess.run(cmd, capture_output=True, text=True)

        # 提取独立 audio
        audio_name = f"{pad2(sid)}-{title}.mp3"

• Confidence: 92% confidence
• Finding: The script uses untrusted storyboard fields, especially scene title, to construct output filenames like clips/{id}-{title}.mp4 and then writes them via ffmpeg. If an attacker can control storyboard-v2.json, they may embed path traversal sequences or absolute paths so the process overwrites files outside the intended output directory, which is especially relevant in a content-generation pipeline that processes project assets automatically.

Unvalidated Output Injection

High

• Category: Output Handling

Content

"-vn", "-c:a", "libmp3lame", "-b:a", "128k", "-ar", "44100",
                str(audio_path)
            ]
            subprocess.run(cmd, capture_output=True, text=True)

        # 提取中间帧
        frame_name = f"{pad2(sid)}-{title}.jpg"

• Confidence: 92% confidence
• Finding: This audio extraction path has the same issue: audio_name is built from untrusted title content and passed to ffmpeg as the output file path. A malicious storyboard can therefore cause arbitrary file overwrite within the user's permissions, potentially clobbering project files or files in adjacent directories.

Unvalidated Output Injection

High

• Category: Output Handling

Content

"-vframes", "1", "-q:v", "2",
                str(frame_path)
            ]
            subprocess.run(cmd, capture_output=True, text=True)

        entry = {
            "uid": f"shot-{sid}",

• Confidence: 92% confidence
• Finding: The frame extraction code repeats the same unsafe pattern for JPEG output paths derived from untrusted scene titles. In this skill context, project metadata and templates are processed locally and automatically, so a poisoned storyboard could write attacker-chosen files anywhere writable by the current user.

Static analysis

No suspicious patterns detected.