Security audit

AIVideomaker

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its stated AIVideoMaker purpose, but its exported client can send the API key and user payloads to an arbitrary custom API origin without validation.

Install only if you trust this skill with your AIVideoMaker API key, prompts, task data, and image inputs. Avoid programmatic use of custom baseUrl unless it is pinned to a trusted HTTPS AIVideoMaker-compatible endpoint, because the current client will send the API key and payload there.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/aivideo-client.mjs:73
Finding: Unrestricted Custom API Origin Can Exfiltrate the API Key and User Payloads
Content: View full analysis
controller.abort(), config.timeoutMs); const headers = { key: config.apiKey, "Content-Type": "application/json", ...extraHeaders, }; try { logger.debug("sending request", { method, url, attempt, headers }); const response = await fetch(url, { method, headers, body: body ? JSON.stringify(body) : undefined, signal: controller.signal, }); ``` ### Technical Analysis `createAIVideoClient` merges caller-supplied options over the secure defaults. Consequently, a caller can replace the default `https://aivideomaker.ai` base URL with an arbitrary destination. The request function then constructs a URL from this unvalidated value and automatically attaches `config.apiKey` as the `key` header. It does not: - Restrict the hostname to `aivideomaker.ai`. - Require the HTTPS protocol. - Reject embedded URL credentials, unexpected ports, or local network destinations. - Bind the API credential to a specific approved origin. Generation requests also include the complete user-supplied payload. Such payloads may contain prompts or base64-encoded images. The ...[truncated 2106 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill performs network-capable operations against an external API but does not declare an explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where the runtime may grant broader-than-intended capabilities, reducing auditability and increasing the chance of unintended network access if the skill is extended or misused.
Content: No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
Content: Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.
md
- Validates input payloads against a defined contract - Reads only payload passed via `--payload` - Does not read arbitrary host files, credentials, or sensitive system information - Does not execute arbitrary code or shell commands All network requests are made to `https://aivideomaker.ai` (or an optional custom base URL configured via client options) and include only the API key for authentication. The API key is sent as an HTTP header named `key` (as required by the AIVideoMaker API). While HTTPS encrypts the transmission, intermediaries may log the `key` header. Users should be aware of privacy implications when sending image data and API keys to upstream services.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest declares only "en" in the language field, which imposes a single-language constraint. Under the policy rule, forcing a specific language without user opt-in or a clearly documented regional/compliance reason is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This is a manifest file, so vague-trigger checks apply. The runtime command list shows what the skill can do, but the manifest provides no explicit invocation phrases, scope limits, or exclusion conditions, making activation boundaries unclear and increasing the risk of unintended invocation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The examples document a GET /api/v1/tasks task-listing capability that is not described in the skill's declared operations. This creates a scope mismatch: an agent or operator may assume the skill only creates, polls, and cancels explicitly referenced tasks, while the undocumented listing endpoint could expose broader account data such as prompts, outputs, timestamps, and model usage for unrelated jobs.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/aivideo-client.mjs:5