豆志刚运镜脚本生成器

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:01 AM UTC
• Version: 1.0.1

Overview

The skill is mostly a disclosed video-script generator, but it includes review-worthy instructions for external video generation, local command execution, and API-key handling.

Review this skill before installing if you plan to use direct video generation. Prefer using only the script/prompt-generation mode unless you trust the RedFoxHub/seedance-video-gen workflow, pass prompts through safe argument handling rather than shell strings, store API keys in a secure secret manager or tightly permissioned environment variable, and check generated people descriptions for unwanted demographic defaults.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: assets/script-template-ai-prompt.md:100

Finding

Shell Command Injection Through Unescaped Generated Prompt Interpolation

Content

View full analysis

Vulnerability Details

File Location: assets/script-template-ai-prompt.md:100-104
Vulnerability Type: Shell command injection
Risk Level: High

Vulnerable Code

bash

python3 "$SKILL_PATH/scripts/videogen.py" "{完整视频生成提示词}" --ratio {9:16或16:9} --resolution 1080p --duration {8/10/12/15} --no-audio --prefix cinematic -o ~/Downloads/QoderVideos

A substantially equivalent command also appears in references/ai-prompts.md:328-332.

Technical Analysis

The command interpolates an Agent-generated video prompt directly into a shell command inside double quotes. The generated prompt is derived from user-supplied scene descriptions or uploaded-image analysis. No escaping, argument-array construction, or validation boundary is specified before execution.

Double quotes do not make arbitrary data safe for shell evaluation. If attacker-controlled content introduces a double quote followed by shell syntax, it can terminate the intended argument and append another command. Command substitutions such as $() and backticks may also be evaluated inside double-quoted shell arguments if preserved in the generated text.

The vulnerability is exploitable when the Agent renders the template into a command string and executes it through a shell. Passing arguments directly to a process API without a shell would prevent this interpretation, but the Skill explicitly presents a Bash command rather than a safe argument-array invocation.

Attack Path

1. An attacker submits a scene description containing shell metacharacters, command substitution, or a quote-breaking payload.
2. The Skill incorporates that description into the generated video prompt.
3. The Agent substitutes the complete prompt into the documented Bash command.
4. The resulting string is executed through a shell.
5. The shell interprets the injected syntax as commands rather than as part of the video prompt.
6. The injected commands execute with the pe ...[truncated 594 chars]

Remediation

View remediation

Remediation Suggestions

• Never construct an executable shell command by interpolating the generated prompt.
• Invoke the video generator with an argument array and with shell processing disabled. For example, use Python's subprocess.run([...], shell=False, check=True).
• Pass large prompts through standard input or a securely created prompt file rather than embedding them in a command string.
• Validate ratio, resolution, and duration against strict allowlists.
• Resolve the output directory to an approved base directory and reject path traversal or unexpected absolute paths.
• Treat all generated prompt text as untrusted, even when it was transformed by the Agent.
• Add regression tests using quotes, semicolons, command substitution, backticks, newlines, and redirection operators.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/ai-prompts.md:338

Finding

API Key Exposure Through Command-Line Arguments and Insecure Plaintext Storage

Content

View full analysis

Vulnerability Details

File Location: references/ai-prompts.md:338-342
Vulnerability Type: Insecure credential handling
Risk Level: Medium

Vulnerable Code

text

| Environment variable | `export REDFOX_API_KEY=ak_密钥` | Globally effective |
| Command-line argument | `--api-key ak_密钥` | Temporary use |
| Configuration file | `mkdir -p ~/.qoder/apis && echo '{"api_key":"ak_密钥"}' > ~/.qoder/apis/redfox.json` | Persistent storage |

Technical Analysis

The Skill recommends supplying the RedFoxHub API key as a command-line argument and writing it directly to a plaintext JSON file.

Command-line secrets may be retained in shell history and can be exposed through process inspection facilities while the command is running. The persistent configuration command does not explicitly create the directory and file with restrictive permissions. The resulting file permissions therefore depend on the user's current umask, potentially allowing other local users or processes to read the credential.

Although the README advises users not to expose keys in plaintext, the operational configuration guidance contradicts that advice by documenting plaintext command-line and file-based storage.

Attack Path

Command-line exposure:

1. A user follows the documented --api-key configuration method.
2. The API key is recorded in shell history or appears in process metadata.
3. Another local principal or compromised process reads the exposed command.
4. The recovered key is reused against the RedFoxHub API.

Configuration-file exposure:

1. A user runs the documented configuration command.
2. The API key is written unencrypted to ~/.qoder/apis/redfox.json.
3. The file inherits permissions determined by the ambient umask.
4. A local process with sufficient filesystem access reads and exfiltrates the key.
5. The attacker uses the credential until it expires or is revoked.

Impact

...[truncated 522 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the command-line API-key option from recommended workflows.
• Obtain credentials from a protected secret manager, operating-system keychain, or securely injected environment variable.
• Prevent commands containing secrets from being stored in shell history.
• If file-based storage is unavoidable, create the directory with mode 0700 and the credential file with mode 0600.
• Create files atomically and verify ownership before reading or replacing them.
• Never print the complete key in logs, status messages, generated prompts, or error output.
• Document key scope minimization, expiration, rotation, and immediate revocation procedures.
• Reconcile the implementation guidance with the README's warning against plaintext key exposure.

T08 · Insecure Dependencies

Note

• Location: assets/script-template-ai-prompt.md:94

Finding

Unpinned Runtime Dependency Installation Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: assets/script-template-ai-prompt.md:94-96
Vulnerability Type: Unsafe third-party dependency installation
Risk Level: Low

Vulnerable Code

markdown

1. **API Key**: Register at https://redfox.hk/settings/api-keys?source=clawhub to obtain `REDFOX_API_KEY`
2. **Python 3.6+**
3. **requests library**: `pip3 install requests`

The same unpinned installation instruction also appears in assets/script-template-standard.md:111-113, references/ai-prompts.md:322-324, and references/core_workflow.md:138-140.

Technical Analysis

The command installs whichever version of requests is currently selected by the user's pip configuration. It does not pin a reviewed version, verify package hashes, identify an approved package index, or require an isolated virtual environment.

The package name itself is legitimate, and the audited project contains no evidence that it intentionally requests a malicious dependency. The risk arises from the installation procedure: a compromised or attacker-controlled package index, altered pip configuration, poisoned mirror, or compromised future release could cause unreviewed code to be installed.

Python packages may execute code during installation or when imported by the external video-generation script. Consequently, dependency compromise can become local code execution.

Attack Path

1. An attacker compromises or controls a package source used by the victim's pip configuration, or a trusted release channel is compromised.
2. The user follows the Skill's instruction to run pip3 install requests.
3. pip resolves and installs an unreviewed package artifact without hash verification.
4. Malicious package logic executes during installation or subsequent import.
5. The malicious code gains the permissions of the user running pip or the video generator.

Impact Assessment

A compromised dependency could execute ar ...[truncated 413 chars]

Remediation

View remediation

Remediation Suggestions

• Pin a reviewed dependency version rather than installing an unconstrained latest release.
• Use a lock file containing cryptographic hashes and install with hash enforcement.
• Explicitly use an approved HTTPS package index or an internally controlled artifact repository.
• Install dependencies inside a dedicated virtual environment rather than the global Python environment.
• Review and update pinned dependencies through a controlled vulnerability-management process.
• Prefer shipping a reproducible dependency manifest with the external seedance-video-gen Skill.
• Document that package installation must not be performed with administrative privileges.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence

Findings (23)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · README.en.md (reported line 13)May include surrounding context.

md

- **Smart image analysis**: Upload an image to automatically identify characters, scene, and lighting, generating a perfectly matched camera script
- **Second-by-second storyboard**: Complete timeline breakdown with subject, camera movement, lighting, and beat-sync for every shot
- **One-click video prompt**: The output prompt can be pasted directly into AI video tools—no manual assembly needed
- **Multi-style support**: Suits formal wear, street fashion, ancient Chinese style, sportswear, and more

**Intended Users**

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The image-to-prompt flow states that uploaded images should be analyzed and then rendered with '全部为东亚面孔', overriding the apparent ethnicity of people in the source image. This is more serious than a generic default because it transforms user-provided visual identity data into a different protected characteristic, causing misrepresentation and potentially offensive or harmful outputs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The usage guidance invites activation from very broad natural-language requests such as generic script or video-generation asks, without clear constraints on supported operations or confirmation boundaries. This can cause unintended invocation or overreach into adjacent tasks, increasing the chance the skill processes sensitive user content or triggers costly downstream actions when the user intent is ambiguous.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The entire skill documentation and example utterances are presented only in Chinese, with no indication that users may choose another language. This can violate language/locale policy where skills should not impose a specific language without opt-in or explicit justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README says users can invoke the skill by 'directly using natural language descriptions' without needing specific commands. This lacks clear trigger boundaries, exclusion conditions, or a constrained phrase list, which can cause unintended activation from ordinary conversation-like requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description and introduction are written as normative behavior in Chinese, including that the skill 'outputs' complete scripts, but nowhere indicates that users may choose another language. This is a natural-language locale policy concern because it implies a fixed language experience without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The template hard-codes '全部为东亚面孔' as a default character requirement without any user opt-in, which introduces unnecessary demographic bias into generated outputs. In a general-purpose video-script skill, this can systematically steer users toward ethnicity-constrained content, creating fairness, inclusion, and policy-compliance risks at scale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The single-person template mandates '东亚面孔' even when no scenario-specific need is established, embedding a demographic constraint into the default generation path. Because this is presented as a standard template, it can normalize biased defaults and reduce user autonomy over representation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The two-person template again fixes both characters as East Asian by default, extending the same representation bias across another primary workflow. Repetition across templates increases the likelihood that all generated outputs inherit the same demographic assumption, amplifying downstream exclusion and compliance concerns.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The style variants continue the same fixed '东亚面孔' requirement, showing this is a systemic template design issue rather than an isolated example. Because these are reusable prompt assets for direct generation, the bias is operationalized across multiple modes and can consistently produce exclusionary or culturally narrowed outputs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The template hard-codes an ethnicity-specific descriptor ('东亚面孔') into the generation prompt without any indication that the user requested or consented to that constraint. This can cause biased or exclusionary outputs, override user intent, and in some settings create discriminatory content defaults tied to protected characteristics.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The template hard-codes '全部为东亚面孔' for all four characters, which imposes an ethnicity restriction without user-driven need or documented justification. In a general-purpose video/script generation skill, this can encode discriminatory defaults into outputs and systematically bias generated content toward exclusionary representations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The prompt template hard-codes '全部为东亚面孔' as a default attribute for generated people, which imposes a protected demographic characteristic without user opt-in or necessity. In a media-generation skill, this can systematically bias outputs, misrepresent user intent, and create discriminatory or exclusionary behavior at scale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The simple-description templates again default all generated people to East Asian faces, even when the user only supplied non-demographic scene or style cues. This introduces avoidable demographic bias into baseline behavior and can normalize protected-attribute assignment where none was requested.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The documentation instructs users to persist the API key in a plaintext file under ~/.qoder/apis/redfox.json, creating a recoverable long-lived secret on disk. If local files are exposed through backup sync, weak file permissions, shared environments, or unrelated compromise, the key can be stolen and abused for unauthorized API usage.

Content

Scanner excerpt · references/ai-prompts.md (reported line 342)May include surrounding context.

md

|------|------|----------|
| 环境变量 | `export REDFOX_API_KEY=ak_密钥` | 全局生效 |
| 命令行参数 | `--api-key ak_密钥` | 临时使用 |
| 配置文件 | `mkdir -p ~/.qoder/apis && echo '{"api_key":"ak_密钥"}' > ~/.qoder/apis/redfox.json` | 持久存储 |

### 6.5 常见问题与处理

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The title and introductory text are written entirely in Chinese and present the guidance as the default reference material, with no indication that users may choose another language or that the Chinese-only format is required for a region-specific purpose. This can violate a language/locale policy when a skill forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The title and introductory description are entirely in Chinese and present the document as a reference for script generation without any indication that other languages are supported. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document states in Chinese that the agent should follow this workflow, and the entire skill workflow is written to operate in Chinese without any opt-in or alternative language handling. This creates a natural-language locale policy concern because it implicitly constrains the interaction language rather than offering user choice.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is presented as a script/prompt generator, but the workflow expands into direct video generation through an external integrated skill and API. This broadens the trust boundary and can trigger external actions, network use, and tool invocation that a user may not expect from a content-authoring skill, increasing the risk of unintended execution and data exposure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow instructs the agent to inspect environment variables, configuration, and local runtime dependencies such as REDFOX_API_KEY, Python, and requests. For a script-writing skill, accessing secrets and probing the local environment is over-privileged and can expose sensitive credentials or system details if the agent is allowed to perform those checks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file is entirely written as a normative reference in Chinese and presents the guidance as the default material to be used when generating scripts. Under the policy, forcing a specific language or locale without user opt-in can be a natural-language policy violation unless the constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The platform adaptation table specifies '中文' as the prompt language for seedance-video-gen, which is a natural-language locale constraint. While this may reflect model best practices, the document does not frame it as optional, user-selectable, or technically required, so it can be read as forcing a language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The text explicitly requires that all four characters be '全部为东亚面孔', which imposes a specific regional/ethnic presentation as a hard constraint. Under the policy, forced language/locale-style constraints without user opt-in or a clear documented justification can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.