豆志刚运镜脚本生成器

• Outcome: Pass
• Latest audit: Jul 10, 2026 · 8:08 AM UTC
• Version: 1.0.1

Overview

This is a disclosed creative video-script skill with optional API-backed video generation, but users should handle API keys and template defaults carefully.

Install this if you want cinematic script and prompt generation and are comfortable with optional RedFox/Seedance API use. Before generating videos, confirm what content will be sent to the external service and what costs may apply. Do not print, paste, or store API keys in plaintext when safer secret storage is available, and review the templates if you want neutral or customizable character demographics.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill is described as a script-generation aid, but this section expands scope into credential setup and direct execution of a video-generation tool. That creates a trust-boundary issue: a user expecting passive prompt help may instead be guided to configure API keys and run commands, increasing the chance of unintended external API use, billing exposure, or unsafe operator behavior.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill is presented as a script-generation workflow, but it later expands into direct video generation through an external integrated skill and API. This creates a capability boundary mismatch: a user or host may grant this skill lower-risk permissions expecting text output, while the workflow attempts networked execution and file-producing side effects.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Including environment inspection, API-key handling, and dependency/runtime checks in a nominally creative scriptwriting skill broadens its operational scope into host reconnaissance. Even without overt exfiltration, probing for installed software and credentials can expose sensitive environmental information and normalize unnecessary access to secrets.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The README explicitly says users can invoke the skill with natural language alone, without a narrow activation boundary. In agent environments, broad activation guidance increases the chance that ordinary user requests unintentionally trigger the skill, causing unexpected access to uploaded images, prompts, or external API-backed actions.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The example trigger '按这个脚本直接生成视频' is highly generic and resembles a normal conversational instruction rather than an unambiguous tool invocation. In a multi-skill agent, this can lead to accidental activation and unintended calls to video-generation workflows or third-party services using user-provided content.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The template hard-codes '全部为东亚面孔' for the default 4-person prompt, imposing a protected-attribute constraint without user opt-in or a clearly documented product requirement. In a generative media skill, this can systematically steer outputs toward a single ethnicity, creating fairness, exclusion, and misuse risks if users expect neutral or customizable character generation.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The single-person template sets '东亚面孔' as the default appearance, which bakes a sensitive demographic trait into standard output behavior. This is risky because repeated defaulting can normalize biased generation and limit inclusive use, especially when the skill is presented as a general-purpose cinematic script generator.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The two-person template again forces all characters to be East Asian by default, extending the same protected-attribute bias across another standard workflow. Because this is embedded in reusable prompt scaffolding, it can propagate non-consensual demographic targeting at scale across many generated outputs.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The style variants continue to default to '东亚面孔' without presenting alternatives, so the bias is not isolated to one sample but repeated as a design pattern. In context, this makes the issue more concerning because the file is a prompt-template library intended for direct reuse, increasing the chance of systematic biased outputs rather than a one-off example.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The template explicitly hard-codes '东亚面孔' as the character appearance in a reusable generation prompt, which constrains ethnicity without user choice or contextual necessity. In a generic cinematic-video skill, this can lead to biased or exclusionary outputs, reinforce stereotypes, and cause inappropriate generation when users expect neutral or customizable character descriptions.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The template hard-codes an ethnic requirement ('全部为东亚面孔') for all characters without making it optional or tying it to a legitimate user-specified narrative need. In a generative media skill, this can systematically steer outputs toward exclusionary or discriminatory representations and propagate biased defaults across many generated scripts.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The workflow explicitly instructs checking for the presence of REDFOX_API_KEY but does not require a prior user-facing warning or consent about credential access. In agent environments, even existence checks against environment variables can cross a sensitive boundary and condition the model to inspect secrets unrelated to the immediate scriptwriting task.

Session Persistence

Medium

• Category: Rogue Agent

Content

|------|------|----------|
| 环境变量 | `export REDFOX_API_KEY=ak_密钥` | 全局生效 |
| 命令行参数 | `--api-key ak_密钥` | 临时使用 |
| 配置文件 | `mkdir -p ~/.qoder/apis && echo '{"api_key":"ak_密钥"}' > ~/.qoder/apis/redfox.json` | 持久存储 |

### 6.5 常见问题与处理

• Confidence: 95% confidence
• Finding: The documentation recommends persisting an API key in a plaintext file under the user's home directory. If file permissions are weak, the account is shared, backups are exposed, or local compromise occurs, the credential can be recovered and abused for unauthorized API consumption and potential billing loss.

Static analysis

No suspicious patterns detected.