Fliz AI Video Generator

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:37 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Fliz API integration guide, but some runnable examples can create billable remote resources or expose webhook data without enough safeguards.

Review before installing or running. Use a dedicated, low-privilege Fliz API key, prefer FLIZ_API_KEY over command-line tokens, avoid submitting confidential text, and do not run or source the example files unless you intend to create videos or consume quota. Treat webhook_handler.py as a local demo only unless you add authentication, remove public debug/history routes, bind it behind a secured proxy, and limit stored webhook data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: assets/examples/webhook_handler.py:63

Finding

Unauthenticated Webhook Ingestion and Public Disclosure of Webhook Payloads

Content

View full analysis

100: webhook_history.pop(0) # Handle different events if step == 'complete': handle_video_complete(payload) elif 'failed' in step: handle_video_failed(payload) else: logger.info(f"Received status update: {step}") ``` ```python def save_video_record(payload): """Save video record to file (example implementation).""" filename = f"videos_{datetime.utcnow().strftime('%Y%m%d')}.jsonl" with open(filename, 'a') as f: record = { "timestamp": datetime.utcnow().isoformat(), **payload } f.write(json.dumps(record) + '\n') lo ...[truncated 2931 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/test_connection.py:71

Finding

API Keys Exposed Through Command-Line Arguments and Terminal Output

Content

View full analysis

.py --api-key YOUR_KEY` ``` ```python parser.add_argument( "--api-key", "-k", help="Fliz API key (or set FLIZ_API_KEY env var)" ) args = parser.parse_args() api_key = args.api_key or os.environ.get("FLIZ_API_KEY") if not api_key: print("Error: API key required. Use --api-key or set FLIZ_API_KEY env var") print("Get your API key at: https://app.fliz.ai/api-keys") sys.exit(1) print(f"Testing connection to {BASE_URL}...") print(f"API key: {api_key[:8]}...{api_key[-4:]}") ``` The other scripts implement the same command-line credential pattern: ```python parser.add_argument("--api-key", "-k", help="Fliz API key (or FLIZ_API_KEY env)") api_key = args.api_key or os.environ.get("FLIZ_API_KEY") if not api_key: print("Error: API key required. Use --api-key or set FLIZ_API_KEY") sys.exit(1) ``` ### Technical Analysis The documentation actively recommends passing a bearer credential through `--api-key`. Command-line arguments may be visible to other local processes through process inspection facilities and may be captured in: - Shell history. - Process-monitoring tools. - CI/CD job logs. - Container and orchestration telemetry. - Endpoint detection and response records. - Support transcripts and command recordings. The connection-testing script additionally prints the first eight and last four characters of the credential. Although this is not the complete token, it unnecessarily exposes a stable credential fingerprint and may reveal a substantial portion of short or structured tokens. The network transmission itself is expected: the bearer token ...[truncated 1352 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: assets/examples/webhook_handler.py:7

Finding

Unpinned Third-Party Runtime Dependencies

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: assets/examples/curl_examples.sh:22

Finding

Example Programs Automatically Perform Mutating and Potentially Billable API Operations

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README encourages users to submit text content to an external API for video generation and translation, but it does not clearly disclose that prompts, article text, product copy, or other potentially sensitive material will leave the local environment and be processed by Fliz. In an agent-skill context, this omission is more dangerous because an automated agent may forward user or repository content to the service without the operator realizing data is being exfiltrated to a third party.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill includes operational guidance that references executable scripts, webhook handlers, API calls, environment-based secrets, file inputs, and network access, but it does not declare any explicit tool restrictions or allowed scope. In an agent environment, this increases the chance that the agent will use broader-than-necessary capabilities such as shell, filesystem, network, or environment access when following the skill, which violates least privilege and can amplify damage if the skill or surrounding inputs are abused.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · assets/examples/curl_examples.sh (reported line 36)May include surrounding context.

sh

# Create a video with minimum required parameters

echo "Creating video (minimal)..."
curl -s -X POST "${BASE_URL}/api/rest/video" \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The createVideo method sets lang = 'en' by default, which imposes a specific language choice in behavior rather than requiring the caller to select one. Under the stated policy, forcing a language without user opt-in is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown documents that when webhook_url is configured, Fliz sends POST requests containing fields such as video_id, url, title, format, and lang to an external callback endpoint. Because this behavior can disclose user or system data to third-party infrastructure, the skill description should explicitly warn users about that privacy-impacting outbound transmission.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/create_video.py (reported line 34)May include surrounding context.

python

}
    
    try:
        response = requests.post(
            f"{BASE_URL}/api/rest/video",
            headers=headers,
            json=body,

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The handler persists full webhook payloads to a local JSONL file even though webhook processing does not require file storage. If payloads contain sensitive metadata, URLs, or future schema additions with secrets or PII, this creates unnecessary data retention and increases exposure through local file disclosure or mishandling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The example writes webhook contents to disk without prominently warning users that incoming data will be stored persistently. In an integration guide, developers may deploy this example as-is and unintentionally retain customer or operational data, creating compliance and privacy risks beyond the stated purpose of simple webhook handling.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The example exposes non-essential endpoints for history viewing and webhook simulation in addition to the actual webhook receiver. While likely intended for debugging, these routes expand the attack surface and can leak recent webhook payloads or allow unauthorized users to trigger fake events, which is unsafe if copied into production unchanged.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The CLI sets --lang to en by default, which imposes a specific language when the user does not explicitly choose one. This is a natural-language policy concern because the tool does not prompt for or otherwise obtain user opt-in before selecting the locale.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.