AI Video Creator

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:55 AM UTC
• Version: 1.0.0

Overview

This skill appears to do what it claims, but it combines real social-media publishing, third-party credentials, unverified executable setup, and unsafe shell-style instructions that users should review before installing.

Install only if you are comfortable giving the workflow Volcengine API credentials and access to a logged-in Xiaohongshu publishing service. Review generated titles, text, tags, and video before posting, prefer private or draft visibility for tests, verify or pin the Xiaohongshu MCP binary and Python dependencies, and avoid running the documented shell snippets with untrusted generated text unless they are rewritten to use structured JSON writing and argument-array execution.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:89
• Finding: Shell Command Injection Through Generated Content<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:89-102` and `SKILL.md:119-128` **Vulnerability Type**: Shell command injection through unsafe interpolation **Risk Level**: High ### Vulnerable Code ```bash # Save prompts cat > {SKILL_DIR}/output/$(date +%Y-%m-%d)/prompts.json << 'EOF' <video_prompts array> EOF # Run the full pipeline python3 {SKILL_DIR}/scripts/video_pipeline.py create \ --prompts {SKILL_DIR}/output/$(date +%Y-%m-%d)/prompts.json \ --output {SKILL_DIR}/output/$(date +%Y-%m-%d) \ --text "<overlay_text separated by |>" \ --bgm-dir {SKILL_DIR}/bgm \ --mood <bgm_mood> ``` ```bash python3 {SKILL_DIR}/scripts/xhs_publish.py video \ --title "<xhs_title>" \ --content "<xhs_content>" \ --video "{SKILL_DIR}/output/$(date +%Y-%m-%d)/final.mp4" \ --tags "<comma-separated tags>" ``` ### Technical Analysis The Skill instructs the agent to substitute generated prompts, overlay text, titles, post content, tags, and mood values directly into shell command text. These values can be influenced by persona files, prompt templates, user input, or model-generated output. Double quotes do not prevent shell evaluation of command substitutions such as `$(command)` or backticks. Embedded quotation marks can also terminate an argument and introduce shell operators. In addition, a prompt containing a line equal to `EOF` can terminate the heredoc early, allowing subsequent lines to be interpreted as shell commands. The affected values are not passed through a structured process API, and the instructions do not require shell-safe quoting or input validation. ### Attack Path 1. An attacker introduces crafted content through a user-supplied topic, modified persona, prompt template, or other input used to generate the post. 2. The generated field contains shell syntax, such as a quote followed by a command separator, a command substitution, or a standalone `EOF` line. 3. The agent substitutes that field into one of the documented shell ...[truncated 776 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not construct shell commands by interpolating generated content. 2. Write `prompts.json` and `metadata.json` with a JSON library rather than a shell heredoc. 3. Invoke Python scripts through a process API using an argument array and with shell evaluation disabled, for example: ```python subprocess.run( [ "python3", pipeline_path, "create", "--prompts", prompts_path, "--output", output_dir, "--text", overlay_text, "--bgm-dir", bgm_dir, "--mood", mood, ], shell=False, check=True, ) ``` 4. Apply an allowlist to `bgm_mood` and validate title, tag, path, and overlay-text lengths and character sets. 5. Pass long-form post content through a temporary file or standard input instead of embedding it in a command. 6. If shell execution is unavoidable, use a platform-appropriate quoting library and reject newlines, heredoc terminators, command substitutions, and shell metacharacters. Structured process invocation remains the preferred control. ]]>

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1
• Finding: Unpinned Volcengine Python Dependency<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:1` **Vulnerability Type**: Unbounded third-party dependency version **Risk Level**: Medium ### Vulnerable Code ```text volcengine>=1.0.0 ``` ### Technical Analysis The dependency declaration accepts every Volcengine package release from version `1.0.0` onward. No lock file, exact version, package hash, or upper bound is supplied. As a result, separate installations can resolve to different package versions. A future compromised, malicious, or incompatible release would satisfy this constraint and could be installed automatically. Python packages can execute code during installation and are subsequently imported by both video-generation scripts. ### Attack Path 1. A malicious or compromised future `volcengine` release is published to the configured Python package index. 2. The release version satisfies the `>=1.0.0` constraint. 3. A user follows the documented `pip install -r requirements.txt` installation procedure. 4. Package installation logic executes, or the malicious package is imported by `scripts/jimeng_client.py` or `scripts/video_pipeline.py`. 5. The package runs with the permissions and environment of the user invoking the Skill. ### Impact Assessment A compromised dependency could execute arbitrary code as the installing or invoking user. It could access Volcengine access and secret keys from environment variables, modify generated files, tamper with API requests, or interact with other resources available to the process. This finding represents a supply-chain exposure rather than evidence that the current Volcengine package is malicious. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to an exact, reviewed version: ```text volcengine==<reviewed-version> ``` 2. Generate and commit a reproducible lock file. 3. Require package hashes during installation, for example by using `pip-compile --generate-hashes` and `pip install --require-hashes`. 4. Review changelogs and dependency changes before updating the pinned version. 5. Install dependencies in an isolated virtual environment with only the permissions required for the video-generation task. 6. Use a trusted package index and consider automated dependency vulnerability and provenance scanning. ]]>

T08 · Insecure Dependencies

Warning

• Location: references/setup.md:43
• Finding: Execution of an Unverified Third-Party Xiaohongshu MCP Binary<. ### Start ```bash ./xiaohongshu-mcp -headless=true -port :18060 ``` ``` ### Technical Analysis The setup procedure instructs users to download or compile and execute a third-party MCP server. It does not pin a release tag or commit, provide an expected checksum, require signature verification, or describe a reproducible build process. The executable is particularly sensitive because it manages Xiaohongshu authentication state and receives publishing requests from `scripts/xhs_publish.py`. Substitution of the binary or compromise of the upstream release channel could therefore provide both local code execution and access to an authenticated social-media workflow. ### Attack Path 1. An attacker compromises the upstream repository, a release asset, the download path, or the user’s dependency-resolution process. 2. The user obtains a modified `xiaohongshu-mcp` binary while following the setup guide. 3. Because no checksum or signature verification is required, the substitution is not detected. 4. The user runs the binary as instructed. 5. The malicious executable runs with the user’s local permissions and can access Xiaohongshu session material or manipulate publishing requests. ### Impact Assessment A substituted MCP executable could execute arbitrary code with the invoking user’s privileges, steal or misuse Xiaohongshu authentication state, publish unauthorized posts, capture content submitted for publication, or modify local files accessible to the account. This finding concerns the unsafe acquisition and verification procedure. The audit found no evidence that the referenced upstream project is currently malicious. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the MCP dependency to a specifically reviewed release and immutable commit. 2. Publish an expected SHA-256 checksum for each supported binary and require users to verify it before execution. 3. Prefer cryptographically signed releases and document signature verification. 4. If building from source, pin all transitive dependencies and provide reproducible build instructions. 5. Run the MCP service under a dedicated, least-privileged account or sandbox. 6. Restrict filesystem and network access to only what publishing requires. 7. Bind the service exclusively to loopback, protect its API with authentication where supported, and ensure other local users cannot submit unauthorized publishing requests. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill claims end-to-end automated creation and publishing while relying on external credentials and networked actions that are not declared in permissions. That mismatch can mislead users about the trust boundary and conceal sensitive operations like third-party API use and account posting.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill claims end-to-end automated creation and publishing while relying on external credentials and networked actions that are not declared in permissions. That mismatch can mislead users about the trust boundary and conceal sensitive operations like third-party API use and account posting.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill claims end-to-end automated creation and publishing while relying on external credentials and networked actions that are not declared in permissions. That mismatch can mislead users about the trust boundary and conceal sensitive operations like third-party API use and account posting.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README promotes one-click publishing to Xiaohongshu and direct use of an MCP server, but it does not explicitly warn users that generated content will be sent to an external platform and may be posted publicly. In the context of an automation skill, this increases the risk of unintended publication, privacy leakage, or account misuse if a user triggers the workflow without understanding the external side effects.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs the agent to use shell commands, read environment variables, read and write files, and invoke network-capable publishing workflows, but it declares no explicit tool scope or permissions. This creates an overbroad execution surface where a user or platform cannot easily constrain sensitive actions such as credential access and external posting.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill involves external publishing to Xiaohongshu and requires Volcengine credentials, but it does not clearly warn users about account impact, privacy exposure, or the possibility of posting generated content to a real social account. In this context, silent use of credentials and automated publication increases the chance of unintended disclosure, account misuse, or reputational harm.

Natural-Language Policy Violations

Medium

• Confidence: 79% confidence
• Finding: This manifest includes a natural-language audience restriction of "22-35岁追求品质生活的女性用户," which imposes a gender-specific targeting policy in the skill definition. Because the file does not indicate that this is user-selectable, opt-in, or required for a justified region/compliance purpose, it may violate organizational expectations against forced demographic constraints.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The entire prompt requires output in Chinese, including Chinese field descriptions and Xiaohongshu-specific title/content requirements, but it does not give the user any option to choose another language or locale. This is a natural-language locale constraint that can violate policy when imposed without explicit user opt-in.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

brew install ffmpeg

# Ubuntu/Debian
sudo apt install ffmpeg

# 验证
ffmpeg -version

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The BGM mood metadata and related AI guidance are written entirely in Chinese, which imposes a specific language on users or downstream agents without any documented opt-in or alternative locale handling. This is a natural-language policy concern because the file provides no mechanism to choose another language or clarify that the skill is intentionally region-specific.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _get_video_duration(path: str) -> float:
    """Get video duration in seconds using ffprobe."""
    try:
        result = subprocess.run(
            [
                "ffprobe", "-v", "error",
                "-show_entries", "format=duration",

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

except (ValueError, AttributeError):
        # Fallback: estimate from file size and typical bitrate
        try:
            result = subprocess.run(
                ["ffprobe", "-v", "error", "-count_frames",
                 "-select_streams", "v:0",
                 "-show_entries", "stream=nb_read_frames,r_frame_rate",

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

fixed_paths = []
    for i, clip in enumerate(clip_paths):
        fixed = os.path.join(output_dir, f"_fixed_{i}.mp4")
        subprocess.run(
            [
                "ffmpeg", "-y", "-i", clip,
                "-c:v", "libx264", "-preset", "fast", "-crf", "18",

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

f.write(f"file '{os.path.basename(path)}'\n")

    # Concat
    subprocess.run(
        [
            "ffmpeg", "-y", "-f", "concat", "-safe", "0",
            "-i", concat_file, "-c", "copy", output_path,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

)

    vf = ",".join(filters)
    result = subprocess.run(
        [
            "ffmpeg", "-y", "-i", input_path,
            "-vf", vf,

• Confidence: 84% confidence
• Finding: User-controlled text is embedded into an ffmpeg drawtext filter string with only partial escaping. Because ffmpeg filter syntax treats multiple characters specially, insufficient escaping can break filter parsing or inject additional filter options/expressions, leading to unintended processing or denial of service when handling crafted overlay text.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# Generate ambient noise as fallback
        print("No BGM files found, generating ambient sound...")
        bgm_file = input_path + ".ambient.mp3"
        subprocess.run(
            [
                "ffmpeg", "-y", "-f", "lavfi",
                "-i", "anoisesrc=d=120:c=pink:r=44100:a=0.025",

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

duration = _get_video_duration(input_path)
    fade_out_start = max(0, duration - 2)

    result = subprocess.run(
        [
            "ffmpeg", "-y", "-i", input_path, "-i", bgm_file,
            "-filter_complex",

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The README instructs users to export Volcengine API credentials but provides no guidance on secure handling, storage, rotation, or avoiding accidental disclosure. While using environment variables is common practice, the lack of warnings in a copy-paste setup flow can lead to secrets being exposed in shell history, screenshots, logs, or misconfigured environments.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: This markdown file contains natural-language instructions exclusively in Chinese and does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the language/locale policy, forcing a specific language without user opt-in can be a policy concern.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

volcengine>=1.0.0

• Confidence: 93% confidence
• Finding: The dependency is specified with a lower bound only, which allows installation of any newer version, including major releases with breaking changes or potentially compromised upstream releases. In an automated content-production skill that may run unattended, this increases supply-chain risk and can lead to unexpected code execution or instability when environments are rebuilt.

Static analysis

No suspicious patterns detected.