Security audit

Iflytek Video Translate

Security checks for vulnerabilities and agentic risk

Overview

This video-translation skill is mostly purpose-aligned, but it includes an under-documented action that can skip manual transcript review and sends credentials/data to a runtime endpoint that does not match the documentation.

Install only if you are comfortable giving the skill iFlytek/XFYUN API credentials and sending video URLs plus task metadata to iFlytek. Before use, reconcile the documented and coded API endpoint, avoid shared or preconfigured credentials, and do not use the confirm_transcript or force_rerun action unless you intentionally want to approve unreviewed transcript content and continue processing.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/xfei_video_translate.py:72
Finding: API credential material is embedded in request query strings
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/xfei_video_translate.py:153
Finding: Undocumented action can skip manual transcript review and force workflow reruns
Content: View full analysis
dict: """Confirm transcript segment, skip manual intervention.""" path = f"/tasks/{task_id}/segments/transcript/confirm" body = {} if force_rerun: body["force_rerun"] = True body_str = json.dumps(body, ensure_ascii=False) if body else "{}" return self._make_request("POST", path, body_str) ``` ```python parser.add_argument( "--action", "-a", choices=[ "create_task", "list_tasks", "get_task", "confirm_transcript" ], default="create_task", help="Action: create_task | list_tasks | get_task | confirm_transcript" ) ``` ```python elif args.action == "confirm_transcript": if not args.task_id: print( "Error: --task_id is required for confirm_transcript.", file=sys.stderr ) sys.exit(1) result = client.confirm_transcript( args.task_id, args.force_rerun ) ``` ### Technical Analysis The declared Skill functionality in `SKILL.md` covers task creation, task listing, and task-detail retrieval. The implementation additionally exposes `confirm_transcript`, which performs a state-changing POST request that skips a manual review stage. The `--force_rerun` option can also restart downstream processing. This capability exceeds the minimum operations described by the Skill. It is especially sensitive because it changes workflow state rather than merely reading task status. The operation does not bypass iFlytek authentication by itself; valid configured credentials are still required. The risk arises from exposing a broader account capability to the Agent without correspond ...[truncated 991 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/xfei_video_translate.py:40
Finding: Runtime API destination conflicts with both documented endpoints
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:74
Finding: Third-party dependency installation is not reproducibly pinned
Content: View full analysis
=2.31.0 ``` ```bash pip install requests ``` ### Technical Analysis The installation instructions allow the package resolver to select arbitrary current or future versions of `requests` and its transitive dependencies from the configured package index. The project provides no lockfile, exact version set, or integrity hashes. This is a supply-chain hardening deficiency rather than evidence that the current dependency is malicious. The package name is not an apparent typosquat, and no untrusted custom package index is specified. ### Attack Path 1. A user follows the documented installation command. 2. `pip` resolves an uncontrolled version from the configured package index. 3. A compromised package release, index, mirror, or transitive dependency is selected. 4. Malicious package code may execute during installation or when the Skill imports the dependency. ### Impact Assessment Compromised dependency code would execute with the privileges of the user running `pip` or the Skill. It could access the configured API credentials, local files available to that user, video metadata, and network resources. The finding does not demonstrate an existing compromise; it identifies a lack of reproducible dependency controls. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Claiming the skill includes pre-configured API credentials without any security warning normalizes use of shared secrets and conceals the associated abuse risk. Users may unknowingly rely on hardcoded credentials that can be extracted, revoked, rate-limited, or used to access task operations tied to a shared account. Because this skill sends user-supplied video jobs to a paid third-party API, the exposure can lead to financial abuse and cross-user privacy issues.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documented behavior says the skill creates, lists, and retrieves translation tasks, but the analysis indicates additional behavior including confirming transcript/manual-review segments and use of credentials with external API calls. Undeclared functionality increases the chance of unintended remote actions and data disclosure because reviewers and users cannot accurately assess what operations the skill may perform.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The README describes submitting video translation tasks to iFlytek but does not warn users that video URLs and associated task data are transmitted to a third-party service. This undermines informed consent and can lead users to expose sensitive media, internal URLs, or metadata to an external processor without realizing it. In a localization skill, third-party transfer is expected, but the lack of disclosure still creates a real privacy and compliance risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The README explicitly states that the skill ships with pre-configured API credentials, which implies embedded shared secrets for a third-party service. Bundled credentials can be abused by anyone with access to the skill, enabling unauthorized API use, billing abuse, and possible access to other users' task metadata. In a video-translation skill, this is especially risky because user video URLs and processing requests are sent to the external provider under those credentials.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill declares executable requirements and relies on environment variables and outbound network access, but it does not explicitly declare tool scope or permissions. This weakens reviewability and user consent because a host system may allow code execution, secret access, and external requests without a clear policy boundary.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill does not clearly warn that user-supplied video URLs, task metadata, and related content are transmitted to a third-party service. This creates a privacy and compliance risk, especially if videos or metadata contain sensitive, proprietary, or regulated information and users are not informed before transfer.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This code file contains multiple hard-coded Chinese status and progress messages for user-facing CLI output, such as video/file descriptions and task-list retrieval text. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation because users are not given any locale selection or English fallback despite the tool otherwise using English CLI arguments and descriptions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script exposes a confirm_transcript action that explicitly skips manual review, but this capability is not described in the skill metadata or top-level usage docs. Hidden workflow-altering functionality is risky because users or orchestrators may invoke the skill expecting only translation/task retrieval, while actually approving unreviewed transcript content that can degrade output quality, bypass human governance, or trigger downstream processing on incorrect text.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The confirm_transcript action skips manual review immediately and does so without an interactive warning, confirmation prompt, or strong acknowledgment mechanism. In a localization workflow, this can cause unreviewed transcripts to be treated as approved, leading to inaccurate translations, unsafe automation decisions, or policy/process bypass where human validation is expected.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest says the skill supports task creation, task list, and task details retrieval. In this README, the documented CLI scope is limited to creating translation tasks and listing tasks, which does not align with the broader capability claimed in the manifest.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The authentication error guidance section is written entirely in Chinese, while the rest of the skill is primarily in English. This imposes a language-specific experience on users without opt-in or justification, which can violate language/locale policy expectations for user-facing skill content.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The module documentation and usage examples omit the confirm_transcript action even though the code exposes it. Undocumented privileged or workflow-changing behavior increases the chance of accidental misuse and reduces reviewability, because operators and security reviewers cannot accurately understand the skill's full behavior from its declared interface.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/xfei_video_translate.py:87