Bee 视频全流程自动化

• Outcome: Review
• Latest audit: May 29, 2026, 9:31 PM
• Version:
  1.0.0

Overview

The skill does what it advertises, but it can move videos to cloud storage, publishing services, and Feishu with weak consent and some under-disclosed local/session dependencies.

Install only if you intend this skill to download videos, upload media to Alibaba OSS, optionally publish through Yixiaoer, and prepare Feishu records. Before use, verify the Feishu destination, inspect or remove any local Douyin cookies file, review the external Yixiaoer publishing script if present, and prefer --no-oss, --no-feishu, or --draft until the workflow is confirmed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The natural-language triggers are broad enough to match ordinary user requests such as 'process this video' or 'upload this video to OSS,' which can cause the automation to activate unexpectedly. In this skill, accidental activation is more dangerous because execution can download content, upload media to cloud storage, publish to social platforms, and write records to 飞书, creating real external side effects.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill description emphasizes convenience but does not warn users that videos, covers, titles, metadata, and possibly account-targeting information will be transmitted to multiple third-party services. Because the workflow includes OSS upload, multi-platform publishing, and 飞书 logging, omission of this disclosure increases the risk of unintended data sharing, privacy violations, and accidental publication.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code uploads the full video and cover to OSS automatically when credentials are present, with no explicit consent prompt or privacy notice at execution time. In a skill handling arbitrary user-supplied media, silent outbound transfer can expose sensitive content or copyrighted material to third-party storage unexpectedly.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The publishing step sends media, cover art, title, description, and tags to an external distribution service if a target is provided, but the code does not present a strong disclosure or confirmation barrier. Because the skill automates cross-platform posting, accidental or unauthorized publication can cause privacy, reputational, and compliance harm.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The Feishu step exports metadata such as title, author, source link, OSS URLs, duration, and publication status to an external system, but only notes this in an internal log message. Users may not realize their content metadata is being recorded in a third-party table, which creates unnecessary privacy and data-governance risk.

VirusTotal

67/67 vendors flagged this skill as clean.