UGC Video Prompt Generator

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:49 AM UTC
• Version: 0.1.0

Overview

This skill is a coherent UGC video prompt and SJinn generation helper, with some install and third-party-sharing cautions but no evidence of hidden or malicious behavior.

Install only if you intend to use SJinn for UGC video generation. Avoid submitting confidential product assets, unreleased campaign material, or personal images unless you are comfortable sending them to SJinn. If you need the fallback install, prefer a pinned and reviewed installer/source instead of the unpinned npx command shown in the skill.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:453

Finding

Unpinned Third-Party Skill Installer Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 453–455
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

markdown

3. **Neither available** — Prompt the user to install one:
   - MCP: Configure the `sjinn` server in `.mcp.json` (`https://mcp.sjinn.ai/mcp`)
   - Basic Skills: Run `npx skills add sjinn-ai/skills`

Technical Analysis

The documented fallback instructs the user to execute the skills npm package through npx without pinning it to an exact, reviewed version. It also installs Skill content from sjinn-ai/skills without specifying a reviewed commit hash, signed release, or integrity digest.

Because npx may retrieve and execute the package version currently resolved by the package registry, the effective installer code can change after this project has been audited. Likewise, the repository content selected by the installer may change over time. This creates a time-of-check/time-of-use supply-chain boundary: reviewing SKILL.md does not establish the integrity of the code or instructions subsequently downloaded and executed.

No evidence in the audited project proves that the referenced package or repository is malicious. The issue is the unsafe, mutable dependency-installation method.

Attack Path

1. An attacker compromises the npm package resolved as skills, its maintainer account, the referenced Skill repository, or another component in the retrieval chain.
2. The attacker publishes a modified package version or replaces remotely retrieved Skill content.
3. A user follows the documented command:

   shell

   npx skills add sjinn-ai/skills
   

4. npx retrieves and executes the currently resolved installer rather than an exact reviewed artifact.
5. The compromised installer or installed Skill executes attacker-controlled behavior under the invoking user's privileges when installed or subsequently invoked.
6. Th ...[truncated 877 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the npm installer to an exact, reviewed version rather than relying on mutable resolution:

   shell

   npx --yes skills@<reviewed-exact-version> add <source-pinned-to-reviewed-commit>
   

2. Pin the Skill source to a reviewed commit hash or immutable signed release instead of a moving repository reference.
3. Publish and verify cryptographic integrity hashes for both the installer package and downloaded Skill artifact.
4. Require package provenance or signature verification and document the expected publisher identity.
5. Prefer downloading and reviewing the artifact before execution rather than allowing npx to retrieve and immediately run it.
6. Run installation with least privilege in an isolated environment without access to unrelated credentials or sensitive files.
7. Add a warning that users must inspect the resolved package version and installed content before activation.
8. Periodically re-audit pinned dependency versions and update pins only after review.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger is broad enough to activate on ordinary requests for ads, testimonials, or selfie-style videos, which can cause the skill to run in contexts the user did not clearly intend. In this skill, that matters because activation can lead to gathering product images and eventually submitting prompts and media to an external generation service, increasing the chance of unintended data handling or surprising tool use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill directs the agent to submit prompt text and reference images to SJinn, but it does not require a clear user-facing disclosure that this information will be transmitted to a third-party service. If users provide proprietary product assets, personal images, or sensitive campaign content, they may unknowingly consent to external sharing, creating privacy, confidentiality, and compliance risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.