T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:160- Finding
API Credential Forwarded to Unvalidated Response-Controlled URLs
- Content
View full analysis
- Remediation
View remediation
Security audit
video-gen
Security checks for vulnerabilities and agentic risk
Overview
The skill has a legitimate video-generation purpose, but its instructions include unsafe handling of personal photos, API credentials, and potentially billable retries.
Review before installing. Only use this skill with non-sensitive photos unless you are comfortable sending them to OpenRouter or other selected providers, set strict cost and retry limits, and avoid the people-frame proof-of-concept unless the skill is fixed to honor its face-scan block rule. Use a limited OpenRouter API key and rotate it if you ran the provided reference code unchanged.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:45- Finding
Deliberate Upload of a People-Containing Photo Contradicts the Privacy Gate
- Content
View full analysis
`). Any frame flagged with faces is **blocked** — never submit it. Seedance refuses frames containing real people with HTTP 400 `InputImageSensitiveContentDetected.PrivacyInformation`, so a flagged frame is a permanent no, not a retry; pull an alternate photo or ask the user. ``` The subsequent risk-POC gate contradicts that control by requiring a people-containing frame to be sent specifically to provoke a content-policy refusal: ```text 3. **Risk-POC gate.** Before the full batch, run a short proof-of-concept (a few 4 s clips) that deliberately samples the risky cases: one frame containing people (expect the content-policy refusal and confirm the fallback path) and one still-life frame (check for near-silent audio or audio flags). Surfacing these landmines costs cents; discovering them mid-batch costs re-renders. ``` The submission procedure encodes and transmits the selected photo to an external API: ```text 3. **Submit a job per clip.** `POST https://openrouter.ai/api/v1/videos` with `model`, `prompt` (from the prompt style guide), `duration`, `resolution`, `aspect_ratio`, and `frame_images` carrying the photo as a base64 **data URL** (`data:image/png;base64,...`) with `frame_type: "first_frame"`. ``` Base64 is only a transport encoding and does not provide confidentiality, anonymization, or privacy protection. The receiving servi ...[truncated 1245 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:175- Finding
Unbounded Resubmission of Billable Video-Generation Jobs
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The reference implementation transmits user-provided prompts and image data, along with an authorization token, to an external service. In a skill handling personal photos and narration scripts, this is a real data exfiltration surface: sensitive user content leaves the local environment and is sent to OpenRouter, and downloaded URLs are also fetched remotely.
- Content
md req.add_header("Authorization", f"Bearer {KEY}") req.add_header("Content-Type", "application/json") data = json.dumps(body).encode() if body is not None else None with urllib.request.urlopen(req, data=data, timeout=120) as resp: return resp.status, json.loads(resp.read().decode()) status, result = call(API, payload)
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code treats any failure whose error text contains "copyright" as transient and automatically resubmits the identical job (L186-L193). But the surrounding documentation says content-policy failures for problematic frames are permanent and must never be retried with the same frame (L204-L206), creating an active contradiction between stated intent and implemented behavior.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The skill directs the agent to fetch third-party media over the network and to create multiple output files, but it does not prominently require explicit user consent at the point of action. That can lead to unexpected network activity, third-party content retrieval, and filesystem writes, which are security-relevant side effects in an agent environment even if the actions are part of the feature's normal behavior.
- Content