剪映AI文字成片_无限

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:23 AM UTC
• Version: 1.0.2

Overview

The skill is a real Jianying desktop automation tool, but it asks for persistent self-modification and uses broad desktop automation, clipboard, screenshots, and runtime package installation with weak controls.

Install only if you are comfortable with a skill controlling your active Windows desktop, overwriting the clipboard, storing storyboard text and screenshots locally, and potentially modifying its own skill instructions. Review or remove the self-modification and no-other-skills directives, avoid runtime pip installation, and run it only in a dedicated desktop session with non-sensitive windows closed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:18

Finding

Persistent Skill Self-Modification and Tool Exclusion

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:18 and SKILL.md:30
Vulnerability Type: Persistent instruction modification and restriction of agent tool selection
Risk Level: High

Evidence

The following source excerpts are represented with Unicode escapes to preserve the exact source content while keeping the report in English-only text:

text

**\u8fed\u4ee3\u4f18\u5316\u539f\u5219**\uff1a\u5728\u5b8c\u6210\u4efb\u52a1\u7684\u8fc7\u7a0b\u4e2d\uff0c\u6bcf\u6210\u529f\u64cd\u4f5c\u4e00\u6b21\uff0c\u5c31\u603b\u7ed3\u65b9\u6cd5\u5e76\u4fee\u6539\u5230\u672c\u6280\u80fd\u6587\u4ef6\u4e2d\u3002

text

\u26a0\ufe0f **\u672c\u6280\u80fd\u80fd\u72ec\u7acb\u5b8c\u6210\u4efb\u52a1\uff0c\u65e0\u9700\u4f9d\u8d56\u5176\u5b83\u4efb\u4f55\u6280\u80fd\uff0c\u4e0d\u8981\u4f7f\u7528\u5176\u5b83\u4efb\u4f55\u6280\u80fd**

The first directive requires the agent to summarize successful operations and modify the Skill file. The second directive states that the Skill must not use any other Skill.

Technical Analysis

These instructions exceed the minimum behavior needed to automate the Jianying desktop application. The self-modification directive creates a mechanism through which observations or generated guidance from one execution can be written into the Skill and subsequently loaded as trusted instructions in later sessions.

The tool-exclusion directive attempts to control the agent's execution environment by prohibiting all other Skills. This can prevent the agent from selecting safer support tools, validation mechanisms, or policy-enforcing Skills. Combined with self-modification, it creates a feedback loop in which unreviewed instructions can become persistent while competing controls are suppressed.

Although the project does not contain a demonstrated payload that writes a specific malicious rule, the explicit instruction to rewrite executable Skill guidance is itself a confirmed unsafe behavior.

A

...[truncated 1219 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the directive requiring the agent to modify SKILL.md after successful operations.
2. Remove the blanket prohibition against using other Skills.
3. Treat Skill definitions as immutable during normal execution.
4. Store operational telemetry or proposed improvements in a separate, non-executable log.
5. Require explicit human review and approval before incorporating proposed changes into Skill instructions.
6. Apply integrity monitoring or source-control review to detect unauthorized Skill changes.
7. Permit the agent to use safety, validation, and support tools according to the platform's normal policy and least-privilege rules.

T08 · Insecure Dependencies

Warning

• Location: jianying_auto.py:30

Finding

Runtime Installation of an Unpinned Third-Party Package

Content

View full analysis

Vulnerability Details

File Location: jianying_auto.py:30-39
Vulnerability Type: Mutable and unverified runtime dependency installation
Risk Level: Medium

Evidence

python

def ensure_pyautogui():
    try:
        import pyautogui
        return pyautogui
    except ImportError:
        subprocess.check_call([
            sys.executable,
            "-m",
            "pip",
            "install",
            "pyautogui",
            "-q"
        ])
        import pyautogui
        return pyautogui

Technical Analysis

If pyautogui is unavailable, normal Skill execution invokes pip and installs the package dynamically. The package is referenced only by name: no exact version, cryptographic hash, lock file, trusted index, or reviewed artifact is specified.

The code therefore executes dependency content that may differ from the content reviewed during this audit. Resolution also depends on the active pip configuration, package index, proxy, and environment. A compromised package release, compromised index, or redirected package source could deliver arbitrary installation-time or import-time code.

The use of an argument array prevents shell injection into the pip command itself, but it does not address the underlying software supply-chain risk.

Attack Path

1. The Skill runs in an environment where pyautogui is not installed or cannot be imported.
2. The ImportError branch invokes the environment's pip executable.
3. Pip resolves the mutable package name using the environment's configured package sources.
4. Pip downloads and installs the resolved package and its dependencies.
5. Package installation hooks or imported module code execute under the same account as the agent.
6. A compromised dependency can access resources available to that account, including project files, user files, network connectivity, clipboard state, and GUI automation capabilities.

...[truncated 547 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove automatic package installation from normal Skill execution.
2. Declare dependencies in a reviewed requirements or lock file.
3. Pin pyautogui and all transitive dependencies to exact reviewed versions.
4. Require cryptographic hashes, such as pip's --require-hashes mode.
5. Install dependencies during an explicit deployment or setup stage rather than on invocation.
6. Use a controlled internal package mirror or explicitly trusted package index.
7. Run the Skill in an isolated virtual environment under a least-privileged account.
8. Fail safely with a clear setup error when the dependency is absent.

T09 · Insecure Skill Coding Practices

Note

• Location: fix_input.py:31

Finding

PowerShell Command Injection Through Unescaped Filesystem Paths

Content

View full analysis

Vulnerability Details

File Location: fix_input.py:31-37; equivalent patterns occur in input_script.py:29-35, run_auto.py:43-48, run_full.py:75-80, run_full_v2.py:92-97, run_now.py:54-57, and SKILL.md:195-199
Vulnerability Type: PowerShell command injection caused by source-string interpolation
Risk Level: Low

Evidence

python

tmp_path = os.path.join(os.getcwd(), 'temp_script.txt')
with open(tmp_path, 'w', encoding='utf-8') as f:
    f.write(content)

ps_cmd = f'Get-Content -Path "{tmp_path}" -Encoding UTF8 -Raw | Set-Clipboard'
result = subprocess.run(
    ['powershell', '-Command', ps_cmd],
    capture_output=True,
    text=True
)

Technical Analysis

The code interpolates tmp_path directly into PowerShell program text supplied through -Command. Quoting the path with double quotes is not sufficient PowerShell escaping. If the current directory or Skill installation path contains a double quote, subexpression, or other PowerShell-significant syntax, the resulting text can be parsed as additional PowerShell expressions or commands.

subprocess.run receives an argument array, which protects the Python-to-process boundary from conventional shell splitting. However, the final argument is deliberately interpreted by PowerShell as source code, and the unescaped path is embedded within that source. The injection boundary therefore exists inside the PowerShell command string.

The default project path shown in the audit does not itself contain an injection payload. Exploitation requires influence over the current directory, deployment directory, or another path component used to construct tmp_path, so the risk is rated Low.

Attack Path

1. An attacker controls or influences the directory from which fix_input.py or input_script.py is launched, or influences the installation directory used by another affected script.
2. The directory name contains PowerShell syntax ca ...[truncated 877 chars]

Remediation

View remediation

Remediation Suggestions

1. Avoid constructing PowerShell source code with interpolated paths.
2. Prefer a Python clipboard API so no command interpreter is required.
3. If PowerShell must be used, pass the path through a separately controlled parameter rather than embedding it in -Command.
4. Use Get-Content -LiteralPath to prevent wildcard interpretation.
5. Apply correct PowerShell escaping to all externally derived values.
6. Create temporary files with Python's tempfile module in a trusted directory.
7. Use restrictive file permissions and guaranteed cleanup through try/finally.
8. Consolidate the duplicated clipboard logic into one reviewed helper to ensure every entry point receives the same fix.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (35)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill states that the current storyboard script is stored in script.txt, and the automation flow also writes the script into temporary local files during clipboard handling, without clearly informing the user that their content will be persisted on disk. Storyboard text may contain unpublished creative content, business plans, personal data, or other sensitive material, so silent local storage creates an avoidable confidentiality risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill captures a full desktop screenshot and saves it to disk (final_state.png) without any explicit user warning or consent specific to screen capture persistence. Because this is a desktop automation skill, the screenshot may unintentionally include unrelated windows, notifications, account details, or other sensitive on-screen content beyond the intended app state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script performs UI automation that clicks a fixed screen coordinate, selects all existing content, and deletes it without any confirmation, preview, or context validation. This can destroy user data in the wrong window or field if focus changes, coordinates are incorrect, or the environment differs from what the author expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script copies the full contents of script.txt into a temporary file and then places that content onto the system clipboard via PowerShell without meaningful disclosure or consent. Clipboard contents are globally accessible to other applications and may expose sensitive data or overwrite a user's existing clipboard unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script forcefully selects and deletes whatever text is in the active input field using GUI automation, with only a status print and no confirmation, validation, or target verification. If focus is on the wrong window or field, it can silently destroy user data or overwrite sensitive content in another application.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · fix_input.py (reported line 37)May include surrounding context.

python

# 使用powershell设置剪贴板
print('设置剪贴板内容...')
ps_cmd = f'Get-Content -Path "{tmp_path}" -Encoding UTF8 -Raw | Set-Clipboard'
result = subprocess.run(['powershell', '-Command', ps_cmd], capture_output=True, text=True)
if result.returncode != 0:
    print(f'PowerShell错误: {result.stderr}')

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · input_script.py (reported line 35)May include surrounding context.

python

# 使用powershell设置剪贴板
print('设置剪贴板内容...')
ps_cmd = f'Get-Content -Path "{tmp_path}" -Encoding UTF8 -Raw | Set-Clipboard'
result = subprocess.run(['powershell', '-Command', ps_cmd], capture_output=True, text=True)
if result.returncode != 0:
    print(f'PowerShell错误: {result.stderr}')

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · run_auto.py (reported line 48)May include surrounding context.

python

# 使用powershell设置剪贴板
print('设置剪贴板内容...')
ps_cmd = f'Get-Content -Path "{tmp_path}" -Encoding UTF8 -Raw | Set-Clipboard'
result = subprocess.run(['powershell', '-Command', ps_cmd], capture_output=True, text=True)
if result.returncode != 0:
    print(f'PowerShell错误: {result.stderr}')

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Adding package-install capability expands the script's privileges beyond simple GUI automation and creates a supply-chain risk surface. Even though the apparent goal is convenience, silently modifying the Python environment at execution time can install unreviewed code and makes the script materially more dangerous than its stated automation purpose suggests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script installs pyautogui without explicit consent, only printing a status message before doing so. Unprompted package installation can surprise users, alter their environment, and execute installer code from external sources, which is especially risky in an agent skill context where users may not expect environment changes.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 92% confidence

Finding

The script invokes pip at runtime via subprocess to install a package automatically. This is dangerous because it executes external package-management actions without prior trust validation, making behavior depend on network, package index integrity, and the local Python environment; a compromised package source or dependency confusion scenario could lead to arbitrary code execution during install.

Content

Scanner excerpt · jianying_auto.py (reported line 37)May include surrounding context.

python

return pyautogui
    except ImportError:
        print("正在安装 pyautogui...")
        subprocess.check_call([sys.executable, "-m", "pip", "install", "pyautogui", "-q"])
        import pyautogui
        return pyautogui

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script performs select-all and delete keystrokes against a GUI text input, which is a destructive action if focus is misplaced or if the field contains valuable content. There is no confirmation prompt or explicit warning immediately before this deletion step.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This script programmatically clicks arbitrary screen coordinates, sends keyboard shortcuts, and overwrites the clipboard, giving it broad control over the active desktop session. In a skill context with no clear trust boundary, that capability can misfire onto the wrong window or be repurposed to manipulate unrelated applications, paste sensitive content, or trigger unintended actions on the user's machine.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The automation relies on Chinese-language UI elements and fixed Chinese option names such as “AI文字成片”, “画面”, and “配音”, which effectively constrain the skill to a specific language/locale without user opt-in or documented justification. This is a natural-language policy concern because the file does not offer any language selection or explain that it is intentionally region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script writes user-provided text to a temporary file and deletes it without notifying the user or guaranteeing secure cleanup. That can expose potentially sensitive script contents to other local processes, backups, or forensic recovery, especially if the script crashes before deletion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script silently replaces the system clipboard contents via PowerShell, which may destroy user data or expose sensitive text to subsequent paste operations and clipboard-monitoring software. Because clipboard changes affect the whole desktop session, this is a privacy and integrity risk even if the automation goal is legitimate.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · run_full.py (reported line 49)May include surrounding context.

python

Write-Host "ERROR: JianyingPro not found"
}
'''
result = subprocess.run(['powershell', '-Command', ps_activate], capture_output=True, text=True, encoding='utf-8', errors='replace')
print(result.stdout.strip() if result.stdout else "No output")

time.sleep(2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The automation unconditionally selects all text in the target input and deletes it without confirming the active window state or obtaining user approval. In GUI automation, misfocus or coordinate drift can cause deletion in the wrong application or field, leading to unintended data loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script places the user's script text into the system clipboard without warning or consent. Clipboard contents are globally accessible to many applications and may overwrite sensitive existing clipboard data, creating both privacy and integrity concerns.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 87% confidence

Finding

This subprocess call constructs a PowerShell command by interpolating a filesystem path into the command string. Although the path is derived from a fixed skill directory, shelling out to PowerShell for clipboard operations creates unnecessary command-surface risk and can break or be abused if the path contains special characters or if the environment is manipulated.

Content

Scanner excerpt · run_full.py (reported line 80)May include surrounding context.

python

f.write(script_text)

ps_cmd = f'Get-Content -Path "{tmp_path}" -Encoding UTF8 -Raw | Set-Clipboard'
result = subprocess.run(['powershell', '-Command', ps_cmd], capture_output=True, text=True, encoding='utf-8', errors='replace')
print(f"Clipboard set: return code {result.returncode}")
if result.stderr:
    print(f"Stderr: {result.stderr[:200]}")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The code writes the full script text to a temporary file on disk and then deletes it without disclosing this behavior to the user. This is dangerous because sensitive content may be left recoverable on disk, exposed to other local processes, or retained if deletion fails, especially in an automation tool handling arbitrary user-provided text.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script silently launches PowerShell and alters the system clipboard without explicit user consent or warning. In a GUI automation skill, undisclosed execution of external interpreters and clipboard modification is risky because it can expose sensitive text, disrupt user workflows, or normalize hidden command execution.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · run_full_v2.py (reported line 97)May include surrounding context.

python

f.write(script_text)

ps_cmd = f'Get-Content -Path "{tmp_path}" -Encoding UTF8 -Raw | Set-Clipboard'
result = subprocess.run(['powershell', '-Command', ps_cmd], capture_output=True, text=True, encoding='utf-8', errors='replace')
print(f"Clipboard set: return code {result.returncode}")

# Paste

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script captures and saves a screenshot of the application state to disk without explicit notice or consent. In GUI automation, screenshots can inadvertently store sensitive user content, account information, or unpublished media, making silent persistence of images a privacy and data-handling vulnerability.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · run_now.py (reported line 23)May include surrounding context.

python

script_text = f.read()

# Get HWND from PowerShell
r = subprocess.run(['powershell', '-Command',
    '(Get-Process JianyingPro -ErrorAction SilentlyContinue | Where-Object { $_.MainWindowHandle -ne 0 }).MainWindowHandle'],
    capture_output=True, text=True)
MAIN_HWND = int(r.stdout.strip())

Static analysis

No suspicious patterns detected.