Idr Avatar Video

• Outcome: Review
• Latest audit: Jun 29, 2026 · 11:13 PM UTC
• Version: 1.0.0

Overview

This video-generation skill appears purpose-aligned, but it sends user content and an API token to a remote service over plain HTTP and leaves generated text files behind locally.

Install only if you are comfortable sending video scripts, selected audio files, account asset metadata, and your service token to the provider. Avoid confidential or regulated content, treat IDR_USER_TOKEN as a secret, and prefer a version that uses HTTPS, deletes temporary text files, and pins dependencies.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (18)

Tainted flow: 'payload' from open (line 298, file read) → requests.post (network output)

High

• Category: Data Flow

Content

headers = get_client_header()
    try:
        url = f"{IDR_VIDEO_URL}/video/skill/gen"
        resp = requests.post(url, headers=headers, json=payload)
        resp.raise_for_status()
        data = resp.json()
        if data.get("code") == CODE_SUCCESS:

• Confidence: 83% confidence
• Finding: User-provided text is sent to an external video-generation service, which is a real outbound data transfer even though the analyzer's stated source is imprecise. In this skill context, sending prompt/script content off-box can expose sensitive business or personal information if users are not clearly warned.

Tainted flow: 'payload' from open (line 298, file read) → requests.post (network output)

High

• Category: Data Flow

Content

headers = get_client_header()
    try:
        url = f"{IDR_VIDEO_URL}/video/inference"
        resp = requests.post(url, headers=headers, files=payload)
        resp.raise_for_status()
        data = resp.json()
        if data.get("code") == CODE_SUCCESS:

• Confidence: 95% confidence
• Finding: This function uploads a local audio file to a remote service using multipart form data. That is a genuine data-exfiltration risk for sensitive local content, especially because the destination is configured over plain HTTP and there is no user confirmation or restriction on what file may be uploaded.

Tainted flow: 'payload' from open (line 298, file read) → requests.post (network output)

High

• Category: Data Flow

Content

headers = get_client_header()
    try:
        resp = requests.post(url, headers=headers, files=payload)
        resp.raise_for_status()
        data = resp.json()
        if data.get("code") == CODE_SUCCESS:

• Confidence: 94% confidence
• Finding: This code writes user text to a local file and then uploads that file to the remote inference service. The combination of local persistence plus external transmission increases privacy risk and can leak sensitive text without meaningful notice.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill requires network access and environment-stored credentials but does not declare permissions up front. This can lead users or hosting agents to invoke the skill without clear consent boundaries, increasing the risk of unintended data transmission to the external service and misuse of local secrets.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The declared description says the skill creates videos, but the documented behavior also enumerates public/private resources, previews audio, fetches avatar images, and checks tasks. This broader operational scope means users may authorize a seemingly narrow video-creation skill that can also access and expose account-linked assets and metadata.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger keywords are generic phrases like '创建视频' and '生成视频', which can match many unrelated user requests. Overbroad activation can cause accidental invocation of a networked third-party skill, potentially sending user content externally when they did not intend to use this provider.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The visible skill description does not warn that use requires network access and transmits user-provided text and selections to an external service. This undermines informed consent and may expose sensitive user content to a third party unexpectedly.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The setup instructions tell users to store an API key in an environment variable but do not warn that the token is sensitive and must not be exposed in prompts, logs, screenshots, or checked-in files. This omission can lead to accidental credential leakage during configuration or troubleshooting.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation instructs users to submit text and audio to a remote video-generation service and retrieve a hosted video URL, but it does not warn that user-provided content is being transmitted to an external system. This can lead users to unknowingly upload sensitive personal, proprietary, or regulated data, creating privacy, compliance, and data-governance risks.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill reads an authentication token from the environment and automatically places it into outbound Authorization headers. In this context that is sensitive credential handling, and the risk is amplified because requests are sent to an HTTP endpoint, allowing token interception in transit.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This code transmits user text to a third-party service without an explicit user-facing warning about network transfer or data handling. In a content-generation skill, users may paste confidential scripts, making silent transmission materially risky.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The script writes user-provided text to a local file in the current working directory without disclosure or cleanup. While not an exploit by itself, it can leave sensitive content behind on disk where other local users or processes may access it.

External Transmission

Medium

• Category: Data Exfiltration

Content

headers = get_client_header()
    try:
        url = f"{IDR_VIDEO_URL}/video/skill/gen"
        resp = requests.post(url, headers=headers, json=payload)
        resp.raise_for_status()
        data = resp.json()
        if data.get("code") == CODE_SUCCESS:

• Confidence: 84% confidence
• Finding: This is a real external transmission of user-provided content to a remote service. In this skill's purpose that behavior is expected, but it still creates privacy and compliance risk if users are not informed and if transport security is weak.

Hidden Instructions

High

• Category: Prompt Injection

Content

我可以帮你查询数字人、音色和模板资源，也可以根据你的需求生成数字人视频。
你可以这样问我：

🧑‍💼 “帮我查询可用的数字人，以及看一下数字人的分辨率。”
🎙️ “有哪些音色可以选择？我想试听一下。”
🎬 “帮我看看有哪些视频模板。”
✨ “我想用商务现场模板生成一段产品介绍视频。”

• Confidence: 75% confidence
• Finding: The skill contains strong agent-behavior instructions telling the assistant to output specific text '原样输出，不要改写'. In a skill file, such hidden or embedded control instructions can override normal safety, transparency, or consent flows and are especially risky because they attempt to steer runtime behavior rather than merely document functionality.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests

• Confidence: 98% confidence
• Finding: The dependency is unpinned, so installs may resolve to different versions over time, including newly introduced breaking changes or vulnerable releases. This weakens build reproducibility and increases supply-chain risk, especially for a skill that likely makes network requests to external video/avatar services.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: The file declares `requests` without constraining it to a non-vulnerable version, and the package has multiple known advisories. In a skill that likely communicates with remote services and may handle credentials, tokens, or user-supplied URLs, vulnerable HTTP client behavior can lead to credential leakage, request validation issues, or other network-layer compromise.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

import argparse
from pathlib import Path

DEFAULT_AUTH = None
IDR_VIDEO_URL = "http://a1.neural-avatar.com:8004"
MEMORY_FILE = Path(__file__).parent / "memory.json"
CODE_SUCCESS = 200

• Confidence: 88% confidence
• Finding: The client is configured with an insecure default endpoint using plain HTTP, and token handling falls back to None rather than enforcing secure authenticated operation. In practice this creates unsafe defaults that can leak credentials and content or cause accidental unauthenticated requests.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: idr-avatar-video
description: 使用视频模板创建视频或者使用数字人和音色创建视频
license: MIT
trigger_keywords:
  - "制作视频"

• Confidence: 67% confidence
• Finding: The metadata and hidden-instruction indicators suggest possible tool/manifest prompt poisoning characteristics, especially combined with imperative assistant-control text in the skill body. Even if not overtly malicious, such patterns can manipulate how an agent interprets tool metadata and increase the chance of unsafe autonomous behavior.

Static analysis

No suspicious patterns detected.