Anima

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:33 PM UTC
• Version: 3.3.2

Overview

The skill’s video-generation purpose is mostly disclosed, but crafted script text, target IDs, paths, or CSV entries can reach shell commands and may execute local commands or overwrite files.

Review before installing. Only run this skill with scripts, CSV files, target IDs, and paths you fully trust, and prefer a sandboxed account. Avoid Feishu delivery or Gemini batch generation until the shell calls are replaced with safe argument-array subprocess calls or native HTTP APIs, and filenames/recipient IDs are validated.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: run.js:93

Finding

Shell Command Injection Through the Target Identifier

Content

View full analysis

; #` could escape the argument context and execute an additional command. ### Impact Assessment Successful exploitation provides arbitrary command execution under the account running the Skill. The attacker could read or modify accessible files, obtain API credentials from the local environment or `.env` file, alter generated media, install additional payloads, or access other resources available to that account. ]]>

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: src/director.js:45

Finding

Shell Command Injection Through TTS Script Text

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: src/send_video_pro.js:29

Finding

Multiple Shell Injection Boundaries in Feishu Delivery

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/batch_generator.js:75

Finding

Shell Command Injection Through Gemini API Configuration

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/batch_generator.js:35

Finding

Path Traversal Allows Arbitrary File Writes During Sprite Generation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/batch_generator.js:71

Finding

Predictable Temporary Payload File Enables Disclosure and Symlink Overwrite

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (41)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The skill advertises media generation but also documents Feishu authentication, local file processing, cover extraction, and message sending to chat targets. In context, this expands the trust boundary from local rendering to external delivery and secret handling; if unnoticed, it can enable unauthorized data exfiltration or unintended outbound communication.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill advertises media generation but also documents Feishu authentication, local file processing, cover extraction, and message sending to chat targets. In context, this expands the trust boundary from local rendering to external delivery and secret handling; if unnoticed, it can enable unauthorized data exfiltration or unintended outbound communication.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill advertises media generation but also documents Feishu authentication, local file processing, cover extraction, and message sending to chat targets. In context, this expands the trust boundary from local rendering to external delivery and secret handling; if unnoticed, it can enable unauthorized data exfiltration or unintended outbound communication.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md

- `src/batch_generator.js`: Batch sprite generator. Uses Gemini image generation to produce sprite variants.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

md

- `src/batch_generator.js`: Batch sprite generator. Uses Gemini image generation to produce sprite variants.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.

md

- `src/batch_generator.js`: Batch sprite generator. Uses Gemini image generation to produce sprite variants.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 247)May include surrounding context.

md

- `src/batch_generator.js`: Batch sprite generator. Uses Gemini image generation to produce sprite variants.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · run.js (reported line 2)May include surrounding context.

js

// Load .env from skill folder only (least-privilege: never read parent .env)
const path = require('path');
require('dotenv').config({ path: path.resolve(__dirname, '../.env') });
const fs = require('fs');

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/batch_director.js (reported line 4)May include surrounding context.

js

// Load .env from skill folder only (least-privilege: never read parent .env)
const path = require('path');
require('dotenv').config({ path: path.resolve(__dirname, '../.env') });
const fs = require('fs');

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/batch_generator.js (reported line 5)May include surrounding context.

js

// Load .env from skill folder only (least-privilege: never read parent .env)
const path = require('path');
require('dotenv').config({ path: path.resolve(__dirname, '../.env') });
const fs = require('fs');

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/batch_generator.js (reported line 32)May include surrounding context.

js

// Load .env from skill folder only (least-privilege: never read parent .env)
const path = require('path');
require('dotenv').config({ path: path.resolve(__dirname, '../.env') });
const fs = require('fs');

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/batch_generator.js (reported line 48)May include surrounding context.

js

// Load .env from skill folder only (least-privilege: never read parent .env)
const path = require('path');
require('dotenv').config({ path: path.resolve(__dirname, '../.env') });
const fs = require('fs');

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/director.js (reported line 3)May include surrounding context.

js

// Load .env from skill folder only (least-privilege: never read parent .env)
const path = require('path');
require('dotenv').config({ path: path.resolve(__dirname, '../.env') });
const fs = require('fs');

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/send_video_pro.js (reported line 1)May include surrounding context.

js

// Load .env from skill folder only (least-privilege: never read parent .env)
const path = require('path');
require('dotenv').config({ path: path.resolve(__dirname, '../.env') });
const fs = require('fs');

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · run.js (reported line 3)May include surrounding context.

js

// Load .env from skill folder only (least-privilege: never read parent .env)
const path = require('path');
require('dotenv').config({ path: path.resolve(__dirname, '../.env') });
const fs = require('fs');
const { execSync } = require('child_process');

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/batch_director.js (reported line 5)May include surrounding context.

js

// Load .env from skill folder only (least-privilege: never read parent .env)
const path = require('path');
require('dotenv').config({ path: path.resolve(__dirname, '../.env') });
const fs = require('fs');
const { execSync } = require('child_process');

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/batch_generator.js (reported line 6)May include surrounding context.

js

// Load .env from skill folder only (least-privilege: never read parent .env)
const path = require('path');
require('dotenv').config({ path: path.resolve(__dirname, '../.env') });
const fs = require('fs');
const { execSync } = require('child_process');

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/director.js (reported line 4)May include surrounding context.

js

// Load .env from skill folder only (least-privilege: never read parent .env)
const path = require('path');
require('dotenv').config({ path: path.resolve(__dirname, '../.env') });
const fs = require('fs');
const { execSync } = require('child_process');

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/send_video_pro.js (reported line 3)May include surrounding context.

js

// Load .env from skill folder only (least-privilege: never read parent .env)
const path = require('path');
require('dotenv').config({ path: path.resolve(__dirname, '../.env') });
const fs = require('fs');
const { execSync } = require('child_process');

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill documents use of shell execution, environment variables, external APIs, and outbound delivery, but declares no explicit tool scope or allowed-tools policy. This weakens containment and review because an agent may grant broader runtime capabilities than the skill's stated interface suggests, increasing the chance of unintended command execution or secret access.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

md

### 1. System Dependencies
- **ffmpeg** (required for video processing):
  - macOS: `brew install ffmpeg`
  - Linux: `sudo apt install ffmpeg`
  - Windows: Download/Install FFmpeg and add to PATH.

### 2. Node Dependencies

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 256)May include surrounding context.

md

### 1. System Dependencies
- **ffmpeg** (required for video processing):
  - macOS: `brew install ffmpeg`
  - Linux: `sudo apt install ffmpeg`
  - Windows: Download/Install FFmpeg and add to PATH.

### 2. Node Dependencies

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documented fallback to the macOS say command introduces undeclared shell-dependent behavior outside the primary API-based design. Hidden or automatic execution of local system commands increases attack surface, complicates sandboxing, and may produce unexpected data handling or command invocation on the host.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file uses child_process.execSync to invoke shell commands for both network access and sleeping. Although the stated purpose of the skill does involve image generation and external API calls, constructing a shell command with interpolated data such as the API key introduces unnecessary command-execution risk and expands the attack surface beyond what is needed.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

The script transmits locally sourced content, including a base image and user-controlled prompt data from the CSV, to an external Google Gemini endpoint. External transmission is expected for this skill's purpose, but it still poses data exposure risk, especially because the request is made through curl with the API key embedded in the command line where it may be exposed to process inspection or logs.

Content

Scanner excerpt · src/batch_generator.js (reported line 75)May include surrounding context.

js

const payloadPath = path.resolve(__dirname, '../temp/_gen_payload.json');
    fs.writeFileSync(payloadPath, payload);

    const cmd = `curl -s -X POST "https://generativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash-exp:generateContent?key=${apiKey}" -H "Content-Type: application/json" -d @"${payloadPath}"`;
    const response = JSON.parse(execSync(cmd, { maxBuffer: 50 * 1024 * 1024 }).toString());

    // Clean up payload

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: run.js:22

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/batch_generator.js:76

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/director.js:23

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/send_video_pro.js:20