Security audit

A skill that automates repurposing Chinese social videos (Douyin/Bilibili/Xiaohongshu) to international platforms (TikTok/YouTube/Instagram) via the Lumi API — handling translation, AI dubbing, and publishing in one workflow.

Security checks for vulnerabilities and agentic risk

Overview

This Lumi skill mostly matches its stated purpose, but it can automatically publish repurposed videos to linked social accounts after processing, so users should review it carefully before installing.

Install only if you are comfortable giving Lumi API access to upload/process videos, retrieve connected-account information, view analytics, and publish to linked TikTok/YouTube/Instagram accounts. Before using repurpose workflows, verify that you own or have rights to the source video, confirm the exact target accounts and visibility settings, and avoid auto-publishing content you have not reviewed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (15)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The crawl endpoint explicitly downloads content from third-party Chinese platforms, extracts underlying media, uploads it to OSS, and registers it in the library, yet the spec does not prominently warn users about this external crawling and republication behavior. In this skill context, that is more dangerous because the feature is designed for cross-platform content handling, increasing the chance of unauthorized fetching, copyright/privacy violations, or submission of sensitive/private links that get stored and redistributed.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill description omits a clear privacy notice that user videos, captions, account identifiers, and related metadata will be transmitted to the remote Lumi service. That omission is risky because the workflows involve uploading content, querying connected accounts, and sending publishing metadata to an external API, which can expose sensitive user or business information without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file documents operations that can publish videos to social platforms, auto-publish repurposed content, and retrieve account insights. The description does not include any user warning about public posting effects, use of connected social accounts, or access to account metrics, which are behaviors that can affect user data and privacy.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The OpenAPI spec hard-codes a single production server at a China-specific domain (https://lumipath.cn) with no documented regional constraints, tenant selection, or user consent. In a skill that handles social media account connections and bearer-token authenticated API access, this can route sensitive account metadata and credentials to an unexpected jurisdiction or infrastructure, increasing privacy, compliance, and trust risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The API schema supports an autoPublish object that can automatically post translated content to linked TikTok, YouTube, and Instagram accounts once processing completes, but the spec does not require any explicit confirmation, warning, or consent checkpoint before triggering actions on external accounts. In an agent setting, this increases the risk of unintended publication, especially when user instructions are ambiguous or when an agent chains localization and publishing actions together automatically.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This is a manifest-like OpenAPI JSON file, so vague-trigger checks apply. The descriptions 'One-shot workflow' and 'The fastest workflow for repurposing Chinese platform content' describe capability broadly but do not specify activation constraints, exclusions, or narrow trigger conditions, which could lead an agent to invoke the skill in overly broad content-repurposing contexts.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The natural-language descriptions repeatedly frame the workflow as operating on 'Chinese platform' content, and the supported domains are all Chinese platforms. This imposes a locale-specific scope in the skill description without documenting user choice, opt-in, or a policy justification such as region-specific compliance.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This endpoint performs an irreversible external action: publishing content to third-party social media accounts. Without an explicit user-facing warning or confirmation requirement in the skill/API contract, an agent or client could trigger posting based on ambiguous prompts, causing unauthorized or accidental publication, reputational damage, and disclosure of content to public audiences.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: This manifest file includes a single production server URL at https://lumipath.cn, which implicitly fixes the service to a specific regional domain. Under the language/locale policy, region-specific constraints should be explicitly justified or presented as a user-visible choice; this file provides neither.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The upload endpoint accepts arbitrary public URLs and causes the Lumi backend to fetch remote content, but the skill specification does not surface a clear user-facing warning that content will be transferred to a third-party service and fetched server-side. This can lead to unintended disclosure of sensitive URLs or user data and creates SSRF-adjacent risk if users supply internal or signed links without understanding the fetch behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill description omits a clear privacy notice that user videos, captions, account identifiers, and related metadata will be transmitted to the remote Lumi service. That omission is risky because the workflows involve uploading content, querying connected accounts, and sending publishing metadata to an external API, which can expose sensitive user or business information without informed consent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Most operational instructions, headings, and workflow content from L015 onward are presented only in Chinese. This effectively forces a specific language/locale without stating that the skill is region-specific or offering the user an alternative language.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The repurpose trigger conditions include broad phrases like '搬运'、'复用'、'翻译发布', which can match ordinary user language without clearly signaling that the skill may initiate workflows leading to publication on external platforms. In this skill’s context, that ambiguity is more dangerous because the workflow later defaults to auto-publishing once platforms are specified, increasing the chance of unintended social media actions from an imprecise trigger.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The natural-language instructions are entirely presented in Chinese, and the document does not offer an alternative language or indicate that the skill is intentionally restricted to a Chinese-speaking or region-specific audience. Per the policy, forcing a specific language without user opt-in can be a locale-policy violation.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This is a manifest/config-style file, so vague-trigger review applies. The summary and description describe a general 'Publish a video' capability but do not provide any limiting context, explicit trigger scope, or negative examples, which could make downstream invocation logic overly broad if these fields are used as activation text.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.